NetSight
IP …
medium5.5

CVE-2025-38391

In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: do not index invalid pin_assignments A poorly implemented…

Impact

In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: do not index invalid pin_assignments A poorly implemented DisplayPort Alt Mode port partner can indicate that its pin assignment capabilities are greater than the maximum value, DP_PIN_ASSIGN_F. In this case, calls to pin_assignment_show will cause a BRK exception due to an out of bounds array access. Prevent for loop in pin_assignment_show from accessing invalid values in pin_assignments by adding DP_PIN_ASSIGN_MAX value in typec_dp.h and using i < DP_PIN_ASSIGN_MAX as a loop condition.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 4.19 before 5.4.296
from 5.5 before 5.10.240
from 5.11 before 5.15.187
from 5.16 before 6.1.144
from 6.2 before 6.6.97
from 6.7 before 6.12.37
DebianDebian Linux
Version 11.0

Weakness classification

CWE-125

References