{"id":"CVE-2025-38391","title":"usb: typec: altmodes/displayport: do not index invalid pin_assignments","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: altmodes/displayport: do not index invalid pin_assignments\n\nA poorly implemented DisplayPort Alt Mode port partner can indicate\nthat its pin assignment capa…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 < c93bc959788ed9a1af7df57cb539837bdf790cee","Linux >= 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 < 114a977e0f6bf278e05eade055e13fc271f69cf7","Linux >= 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 < 621d5a3ef0231ab242f2d31eecec40c38ca609c5","Linux >= 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 < 2f535517b5611b7221ed478527e4b58e29536ddf","Linux >= 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 < 45e9444b3b97eaf51a5024f1fea92f44f39b50c6","Linux >= 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 < 5581e694d3a1c2f32c5a51d745c55b107644e1f8","Linux >= 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 < 47cb5d26f61d80c805d7de4106451153779297a1","Linux >= 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 < af4db5a35a4ef7a68046883bfd12468007db38f1","Linux 4.19"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:55:55.581693Z"},"published":"2025-07-25","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:02:36.304Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38391","references":[{"url":"https://git.kernel.org/stable/c/c93bc959788ed9a1af7df57cb539837bdf790cee"},{"url":"https://git.kernel.org/stable/c/114a977e0f6bf278e05eade055e13fc271f69cf7"},{"url":"https://git.kernel.org/stable/c/621d5a3ef0231ab242f2d31eecec40c38ca609c5"},{"url":"https://git.kernel.org/stable/c/2f535517b5611b7221ed478527e4b58e29536ddf"},{"url":"https://git.kernel.org/stable/c/45e9444b3b97eaf51a5024f1fea92f44f39b50c6"},{"url":"https://git.kernel.org/stable/c/5581e694d3a1c2f32c5a51d745c55b107644e1f8"},{"url":"https://git.kernel.org/stable/c/47cb5d26f61d80c805d7de4106451153779297a1"},{"url":"https://git.kernel.org/stable/c/af4db5a35a4ef7a68046883bfd12468007db38f1"}],"tags":["cve.org"],"epss":0.00208,"epssPercentile":0.11012,"ingestedAt":"2026-11-05T22:38:31.966Z","slug":"CVE-2025-38391","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: altmodes/displayport: do not index invalid pin_assignments\n\nA poorly implemented DisplayPort Alt Mode port partner can indicate\nthat its pin assignment capabilities are greater than the maximum\nvalue, DP_PIN_ASSIGN_F. In this case, calls to pin_assignment_show\nwill cause a BRK exception due to an out of bounds array access.\n\nPrevent for loop in pin_assignment_show from accessing\ninvalid values in pin_assignments by adding DP_PIN_ASSIGN_MAX\nvalue in typec_dp.h and using i < DP_PIN_ASSIGN_MAX as a loop\ncondition.\n\n## Affected\n\n- `Linux >= 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 < c93bc959788ed9a1af7df57cb539837bdf790cee`\n- `Linux >= 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 < 114a977e0f6bf278e05eade055e13fc271f69cf7`\n- `Linux >= 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 < 621d5a3ef0231ab242f2d31eecec40c38ca609c5`\n- `Linux >= 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 < 2f535517b5611b7221ed478527e4b58e29536ddf`\n- `Linux >= 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 < 45e9444b3b97eaf51a5024f1fea92f44f39b50c6`\n- `Linux >= 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 < 5581e694d3a1c2f32c5a51d745c55b107644e1f8`\n- `Linux >= 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 < 47cb5d26f61d80c805d7de4106451153779297a1`\n- `Linux >= 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588 < af4db5a35a4ef7a68046883bfd12468007db38f1`\n- `Linux 4.19`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}