CVE-2026-90025
usb: typec: ucsi: displayport: Fix OOB altmode array index
Description
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix OOB altmode array index The UCSI displayport driver indexes the connector's port altmode array with the GET_CURRENT_CAM response after checking it is not 0xff. The port altmode array is UCSI_MAX_ALTMODES elements long. If the PPM returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and not equal to 0xff, the kernel may crash with an array index OOB error. Update the UCSI displayport driver to verify the current cam is less than UCSI_MAX_ALTMODES before accessing the port altmode array.
INFO
Published Date :
Sept. 16, 2026, 11:17 a.m.
Last Modified :
Sept. 16, 2026, 3:18 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the UCSI displayport driver.
- Verify current cam is less than UCSI_MAX_ALTMODES.
- Prevent array index out-of-bounds errors.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-90025.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-90025 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-90025
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-90025 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-90025 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 16, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 16, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix OOB altmode array index The UCSI displayport driver indexes the connector's port altmode array with the GET_CURRENT_CAM response after checking it is not 0xff. The port altmode array is UCSI_MAX_ALTMODES elements long. If the PPM returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and not equal to 0xff, the kernel may crash with an array index OOB error. Update the UCSI displayport driver to verify the current cam is less than UCSI_MAX_ALTMODES before accessing the port altmode array. Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/90xxx/CVE-2026-90025.json">CVE-2026-90025</a> Added Reference https://git.kernel.org/stable/c/04cec690b1fd9d1c4c314b91a10d8c68a3acfe18 Added Reference https://git.kernel.org/stable/c/1ffed96ef986e2cdf986aa4a4506a5e6dcdf4456 Added Reference https://git.kernel.org/stable/c/33a81acd2d1d0667d4eff93cb90339fa53e617e8 Added Reference https://git.kernel.org/stable/c/58e0ee293ec5e06cacbe3953ad44042f1473dae9 Added Reference https://git.kernel.org/stable/c/83f1abd62cc134700ba92e1e2dc650a49a185497 Added Reference https://git.kernel.org/stable/c/8fde7e4a366184e9a6aa95541e52933a73c00a74 Added Reference https://git.kernel.org/stable/c/ac9f878c468052af6571e8639ab1c3ae040b908f Added Reference https://git.kernel.org/stable/c/bdaaf3074aedce8f1b173cc363d61cff5f6a585f