Executive brief
The Linux kernel's USB Type-C UCSI driver for DisplayPort alternate modes contains a boundary check flaw that allows an invalid response from a USB Power Delivery controller to cause a kernel crash. A malicious or faulty USB device could trigger this vulnerability to deny service to the system.
Technical details
The vulnerability is an out-of-bounds (OOB) array access in the UCSI DisplayPort driver. The code indexes the port altmode array using a value from the GET_CURRENT_CAM response, but only validates that it is not 0xff, without checking whether it is less than UCSI_MAX_ALTMODES. If a USB Power Delivery controller (PPM) returns an invalid CAM value above UCSI_MAX_ALTMODES (but not 0xff), the kernel attempts to access memory outside the bounds of the array, causing a crash. The fix changes the boundary check from `if (cur != 0xff)` to `if (cur < UCSI_MAX_ALTMODES)`, ensuring the index is valid before array access. No authentication or user interaction is required; any connected USB device could trigger this via a crafted response.
Affected products
- Linux Linux kernel versions prior to commit 04cec690b1fd9d1c4c314b91a10d8c68a3acfe18
Timeline
- 2026-09-16: disclosed: CVE-2026-90025 published
- 2026-08-31: patched: Patch committed upstream (2026-08-25, merged 2026-08-31)