Deadlock Vulnerability in Linux Kernel's USB Type-C Protocol Management - CVE-2025-38268
Summary
DEBIAN-CVE-2025-38268: In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work A state check was previously added to tcpm_queue_vdm_unlocked to prevent a deadlock... Affects linux versions < 6.12.35-1. Fixed in 6.12.35-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services and managing hardware resources. It supports a wide range of functionalities, including USB Type-C protocol management, which allows devices to communicate and transfer power efficiently. This vulnerability affects the USB Type-C Port Management (TCPM) subsystem, which is responsible for handling the state of USB Type-C connections and ensuring proper communication between devices.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the USB Type-C protocol management that can lead to a deadlock situation. The issue arises from a state check in the function tcpm_queue_vdm_unlocked, which is not adequately protected. This allows a race condition where the DisplayPort Alt Mode driver may attempt to acquire a lock while the TCPM is already holding it, leading to a deadlock. The vulnerability can cause system instability and may affect the performance of devices relying on USB Type-C connections.
How To Fix
Minimum fixed version
6.12.35-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may avoid using the affected USB Type-C features until the patch is applied. However, this is not a permanent solution and updating the package is strongly advised.
Conclusion
The vulnerability CVE-2025-38268 in the Linux kernel's USB Type-C protocol management poses a risk of deadlock, potentially affecting system stability. Users are advised to update to the patched version 6.12.35-1 to mitigate this issue. Temporary workarounds are available, but applying the patch is the best course of action.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38268 is a vulnerability in the Linux kernel related to the USB Type-C protocol management that can lead to a deadlock situation.
This vulnerability can cause system instability and may disrupt the functionality of devices that use USB Type-C connections.
Yes, a patch is available in version 6.12.35-1 of the Linux package. It is recommended to update to this version or later.
As a temporary measure, you can avoid using the affected USB Type-C features until you can apply the patch.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground at Vulert Scanner without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
