usb: typec: displayport: Fix potential deadlock (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.16 % · percentile 5 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: usb: typec: displayport: Fix potential deadlock The deadlock can occur due to a recursive lock acquisition of `cros_typec_altmode_data::mutex`. The call chain is as follows: 1. cros_typec_altmode_work() acquires the mutex 2. typec_altmode_vdm() -> dp_altmode_vdm() -> 3. typec_altmode_exit() -> cros_typec_altmode_exit() 4. cros_typec_altmode_exit() attempts to acquire the mutex again To prevent this, defer the `typec_altmode_exit()` call by scheduling it rather than calling it directly from within the mutex-protected context.
Weaknesses (CWE)
- CWE-667 — Improper Locking
References
- https://git.kernel.org/stable/c/749d9076735fb497aae60fbea9fff563f9ea3254
- https://git.kernel.org/stable/c/eb08fca56f1f39e4038cb9bac9864464b13b00aa
- https://git.kernel.org/stable/c/7be0d1ea71f52595499da39cea484a895e8ed042
- https://git.kernel.org/stable/c/76cf1f33e7319fe74c94ac92f9814094ee8cc84b
- https://git.kernel.org/stable/c/63cff9f57e86b2dc25d7487ca0118df89a665296
- https://git.kernel.org/stable/c/c782f98eef14197affa8a7b91e6981420f109ea9
- https://git.kernel.org/stable/c/80c25d7916a44715338d4f8924c8e52af50d0b9f
- https://git.kernel.org/stable/c/099cf1fbb8afc3771f408109f62bdec66f85160e
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2025-22598
- GCVE · GCVE-0-2025-38404
CERT-FR advisories
- CERTFR-2025-AVI-1073 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0894 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0759 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0745 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0723 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0698 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:6.1.143:*:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.6.96:*:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.12.36:*:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.15.5:*:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected e0359c66c1beccbe90119a63391678eabda38007 < 749d9076735fb497aae60fbea9fff563f9ea3254 ; affected e3fb6c2c3939b4aad203cacdd613a62ce1fd032c < eb08fca56f1f39e4038cb9bac9864464b13b00aa ; affected 56846793f105cf2b39ecbde4f3ae86342091f6fc < 7be0d1ea71f52595499da39cea484a895e8ed042 ; affected 8e8a69b1f8c59f0505f8a1c0fb77191f27b75011 < 76cf1f33e7319fe74c94ac92f9814094ee8cc84b ; affected 8851e40587013db00b71d4aeaae30f5fd59b0eec < 63cff9f57e86b2dc25d7487ca0118df89a665296 ; affected 10cc2cfd3e5d0e0ec7590c4bee8bcea10e5492c4 < c782f98eef14197affa8a7b91e6981420f109ea9 |
| Linux · Linux | affected 6.1.143 < 6.1.144 ; affected 6.6.96 < 6.6.97 ; affected 6.12.36 < 6.12.37 ; affected 6.15.5 < 6.15.6 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |