CVE-2025-38391

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: altmodes/displayport: do not index invalid pin_assignments

A poorly implemented DisplayPort Alt Mode port partner can indicate that its pin assignment capabilities are greater than the maximum value, DP_PIN_ASSIGN_F. In this case, calls to pin_assignment_show will cause a BRK exception due to an out of bounds array access.

Prevent for loop in pin_assignment_show from accessing invalid values in pin_assignments by adding DP_PIN_ASSIGN_MAX value in typec_dp.h and using i < DP_PIN_ASSIGN_MAX as a loop condition.

This patch addresses a potential out-of-bounds array access in the DisplayPort Alt Mode driver for USB Type-C. If a connected device advertises invalid pin assignments beyond the supported DP_PIN_ASSIGN_F, the kernel function pin_assignment_show() may access memory outside the valid range, leading to a BRK exception or kernel crash. The patch introduces a maximum pin assignment limit to prevent this.

The vulnerability is externally triggerable via a malicious or misbehaving USB-C device and may lead to denial-of-service or minor information disclosure through out-of-bounds reads.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.