CVE-2026-90025

The Linux kernel's USB Type-C UCSI DisplayPort altmode driver uses the GET_CURRENT_CAM response from the platform policy manager (typically the USB-C firmware on a laptop or dock) to index the connector's port altmode array, checking only that the value is not 0xff. If the PPM returns an invalid value greater than UCSI_MAX_ALTMODES, the driver performs an out-of-bounds array access that can crash the kernel and may expose kernel memory. Per the CVSS vector (AV:L, no privileges required), a local attacker who can induce such a response, e.g., through a malicious or buggy USB-C device, gains denial of service and potentially information disclosure. Affected systems are Linux machines running kernels with the UCSI DisplayPort altmode driver enabled, which is standard on USB-C-capable laptops and desktops in mainstream distributions. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation exists.

What to do: Update to a Linux kernel that includes the upstream fix validating that the GET_CURRENT_CAM value is below UCSI_MAX_ALTMODES, and track your distribution's kernel errata since exact fixed version numbers are not provided in the data. Until patched, be cautious with untrusted USB-C docks and monitors, and consider unloading or blacklisting the ucsi DisplayPort altmode module on systems that do not need DisplayPort over USB-C. Because the attack vector is local, internet-exposed servers without local users face minimal risk.