CVE-2026-90025

A flaw was found in the Linux kernel's USB Type-C DisplayPort (UCSI displayport) driver. An attacker with physical proximity or control over a connected USB-C device could provide a specially crafted response from the Port Partner Manager (PPM). This invalid response could cause an out-of-bounds array access, leading to a kernel crash and a denial of service (DoS) on the affected system.

Red Hat rates this vulnerability as Moderate because exploitation requires local access or the physical attachment of a rogue peripheral, restricting the blast radius strictly to a kernel crash and denial of service. In standard enterprise server and cloud deployments of Red Hat Enterprise Linux and OpenShift Container Platform, physical interface access is restricted or absent, significantly limiting real-world exposure. Systems with exposed USB-C interfaces or emulated peripherals remain susceptible to a system crash if an untrusted partner device negotiates an invalid alternate mode index.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.