CVE-2026-90025 usb: typec: ucsi: displayport: Fix OOB altmode array index
A malicious USB device can trigger an out-of-bounds array access in the Linux kernel UCSI displayport driver, causing a system crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90025?
CVE-2026-90025 is a high-severity memory corruption vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: ucsi: displayport: Fix OOB altmode array index
The UCSI displayport driver indexes the connector's port altmode array with the GET_CURRENT_CAM response after checking it is not 0xff. The port altmode array is UCSI_MAX_ALTMODES elements long. If the PPM returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and not equal to 0xff, the kernel may crash with an array index OOB error.
Update the UCSI displayport driver to verify the current cam is less than UCSI_MAX_ALTMODES before accessing the port altmode array.
Which versions are affected by CVE-2026-90025?
How do I fix CVE-2026-90025?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-90025 being exploited?
There is no known exploitation of CVE-2026-90025 in the wild and no public exploit code.
Sources
Also known as AZL-101592, BELL-CVE-2026-90025, DEBIAN-CVE-2026-90025, GHSA-hg73-43cm-xh29, UBUNTU-CVE-2026-90025.