Critical Vulnerability in Linux Kernel: Out of Bounds Access in DisplayPort Alt Mode Handling
Summary
CVE-2025-38391: In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: do not index invalid pin_assignments A poorly implemented DisplayPort Alt Mode port partner can indicate that its pin... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management, process control, and system security. It supports a wide range of hardware architectures and is known for its stability and performance. However, it is also susceptible to vulnerabilities that can compromise system integrity. This specific vulnerability affects the USB Type-C DisplayPort Alt Mode functionality, which is crucial for video output and data transfer.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the handling of DisplayPort Alt Mode pin assignments. A poorly implemented DisplayPort Alt Mode port partner can falsely indicate that its pin assignment capabilities exceed the maximum allowed value, DP_PIN_ASSIGN_F. This discrepancy can lead to an out-of-bounds array access during calls to the pin_assignment_show function, resulting in a BRK exception. Such an exception can cause system instability and potential crashes, posing a significant risk to users relying on this functionality.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. Users are advised to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
The vulnerability CVE-2025-38391 in the Linux kernel poses a significant risk due to its potential to cause system instability through out-of-bounds access in DisplayPort Alt Mode handling. Users are urged to update their systems to the patched version to mitigate this risk and ensure continued system reliability.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38391 is a vulnerability in the Linux kernel related to out-of-bounds access in the DisplayPort Alt Mode handling.
This vulnerability can lead to system crashes and instability, particularly for systems utilizing DisplayPort Alt Mode for video output.
Versions of the Linux kernel prior to the patched version 6.12.37-1 on Debian 13 are affected. Users should check their kernel version to determine if they are at risk.
While there are no specific workarounds, it is crucial to monitor your system for any unusual behavior and apply the patch as soon as possible.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
