EUVD-2026-80633
GHSA-hg73-43cm-xh29
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Local malicious PPM/USB-C partner triggers OOB array-index crash, so AV:L and A:H; the OOB is a read/deref causing panic with no leak or write, so C:N/I:N.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: ucsi: displayport: Fix OOB altmode array index
The UCSI displayport driver indexes the connector's port altmode array with the GET_CURRENT_CAM response after checking it is not 0xff. The port altmode array is UCSI_MAX_ALTMODES elements long. If the PPM returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and not equal to 0xff, the kernel may crash with an array index OOB error.
Update the UCSI displayport driver to verify the current cam is less than UCSI_MAX_ALTMODES before accessing the port altmode array.
AnalysisAI
Out-of-bounds array indexing in the Linux kernel's USB Type-C UCSI DisplayPort alternate-mode driver (drivers/usb/typec/ucsi/displayport.c) can crash the kernel when the UCSI platform firmware returns a GET_CURRENT_CAM response that exceeds UCSI_MAX_ALTMODES without being 0xff. All Linux kernels exposing the ucsi_displayport code path - introduced around 5.2 and present on modern USB-C laptops with DisplayPort alt-mode - are potentially affected; the vector is local (CVSS:3.1/AV:L/AC:L/PR:N/UI:N) and requires either rogue/buggy PPM firmware or a malicious USB-C DisplayPort partner to steer the alternate-mode negotiation, so stock systems with honest firmware are not reachable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the system to run the Linux ucsi_displayport driver (USB Type-C UCSI stack, present on modern USB-C laptops with DisplayPort alt-mode) AND the UCSI PPM (embedded-controller firmware) to return a GET_CURRENT_CAM value that is greater than UCSI_MAX_ALTMODES and not equal to 0xff. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely modest-risk local denial-of-service bug that the vendor CVSS over-scores on confidentiality. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to the fixed stable kernels 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51 or 7.2.5 (mainline 7.3-rc2), or consume the equivalent distro kernel update that backports the added 'current_cam < UCSI_MAX_ALTMODES' bounds check; the upstream stable commits such as https://git.kernel.org/stable/c/8fde7e4a366184e9a6aa95541e52933a73c00a74 document the exact change for downstream backporting. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Linux endpoints and developer workstations running kernels with the ucsi_displayport code path (kernel 5.2 and later, predominantly USB-C laptops and docking-station users), confirm which distributions and kernel branches are in scope against the vendor advisory, and stage the vendor-released fix from that advisory for your standard kernel packages; restrict or monitor use of untrusted USB-C DisplayPort adapters and docks in high-availability environments as an interim measure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today