HIGH Introduced in 5.2
ucsi DisplayPort OOB
CVE-2026-90025
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
KernelScan AI4.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix OOB altmode array index The UCSI displayport driver indexes the connector's port altmode array with the GET_CURRENT_CAM response after checking it is not 0xff. The port altmode array is UCSI_MAX_ALTMODES elements long. If the PPM returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and not equal to 0xff, the kernel may crash with an array index OOB error. Update the UCSI displayport driver to verify the current cam is less than UCSI_MAX_ALTMODES before accessing the port altmode array.
02KernelScan AI Analysis
Risk summary
A USB Type-C UCSI DisplayPort alternate mode handler trusts a firmware-supplied array index without proper bounds checking, allowing an out-of-bounds array access that can crash the kernel. The bug is reachable via USB Type-C hardware/firmware interaction and requires physical access to the affected USB-C port. Impact is limited to denial of service (kernel crash/oops).
Vulnerability analysis
The UCSI DisplayPort driver uses a numeric response from the platform policy manager (firmware) as an index into a fixed-size array of alternate mode entries, but only rejects the sentinel value 0xff without checking whether the value falls within the array bounds. A malformed or malicious firmware response can therefore drive the index past the end of the array, causing an out-of-bounds access that crashes the kernel. The fix replaces the sentinel-only check with a proper bounds comparison so any value outside the valid range is rejected before the array is touched. The vulnerable path is reached through USB Type-C / UCSI interaction, so an attacker needs physical access to a USB-C connector and a device or firmware capable of producing the invalid response; no network or local account is involved.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.2 | 5.10.270 | 8fde7e4a3661 |
| 5.15 | 5.2 | 5.15.221 | 83f1abd62cc1 |
| 6.1 | 5.2 | 6.1.188 | 1ffed96ef986 |
| 6.12 | 5.2 | 6.12.110 | ac9f878c4680 |
| 6.18 | 5.2 | 6.18.51 | 33a81acd2d1d |
| 6.6 | 5.2 | 6.6.157 | 58e0ee293ec5 |
| 7.2 | 5.2 | 7.2.5 | bdaaf3074aed |
| mainline | 5.2 | 7.3 | 04cec690b1fd |
| cip/5.10 | 5.2 | 5.10.271-cip78 | 8fde7e4a3661 |
| cip/6.1 | 5.2 | 6.1.189-cip61 | 1ffed96ef986 |
| cip/6.1-rt | 5.2 | 6.1.189-cip61-rt32 | 1ffed96ef986 |
| cip/6.12 | 5.2 | 6.12.111-cip32 | ac9f878c4680 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |