In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work
A state check was previously added to tcpm_queue_vdm_unlocked to prevent a deadlock where the DisplayPort Alt Mode driver would be executing work and attempting to grab the tcpm_lock while the TCPM was holding the lock and attempting to unregister the altmode, blocking on the altmode driver's cancel_work_sync call.
Because the state check isn't protected, there is a small window where the Alt Mode driver could determine that the TCPM is in a ready state and attempt to grab the lock while the TCPM grabs the lock and changes the TCPM state to one that causes the deadlock. The callstack is provided below:
[110121.667392][ C7] Call trace: [110121.667396][ C7] __switch_to+0x174/0x338 [110121.667406][ C7] __schedule+0x608/0x9f0 [110121.667414][ C7] schedule+0x7c/0xe8 [110121.667423][ C7] kernfs_drain+0xb0/0x114 [110121.667431][ C7] __kernfs_remove+0x16c/0x20c [110121.667436][ C7] kernfs_remove_by_name_ns+0x74/0xe8 [110121.667442][ C7] sysfs_remove_group+0x84/0xe8 [110121.667450][ C7] sysfs_remove_groups+0x34/0x58 [110121.667458][ C7] device_remove_groups+0x10/0x20 [110121.667464][ C7] device_release_driver_internal+0x164/0x2e4 [110121.667475][ C7] device_release_driver+0x18/0x28 [110121.667484][ C7] bus_remove_device+0xec/0x118 [110121.667491][ C7] device_del+0x1e8/0x4ac [110121.667498][ C7] device_unregister+0x18/0x38 [110121.667504][ C7] typec_unregister_altmode+0x30/0x44 [110121.667515][ C7] tcpm_reset_port+0xac/0x370 [110121.667523][ C7] tcpm_snk_detach+0x84/0xb8 [110121.667529][ C7] run_state_machine+0x4c0/0x1b68 [110121.667536][ C7] tcpm_state_machine_work+0x94/0xe4 [110121.667544][ C7] kthread_worker_fn+0x10c/0x244 [110121.667552][ C7] kthread+0x104/0x1d4 [110121.667557][ C7] ret_from_fork+0x10/0x20
[110121.667689][ C7] Workqueue: events dp_altmode_work [110121.667697][ C7] Call trace: [110121.667701][ C7] __switch_to+0x174/0x338 [110121.667710][ C7] __schedule+0x608/0x9f0 [110121.667717][ C7] schedule+0x7c/0xe8 [110121.667725][ C7] schedule_preempt_disabled+0x24/0x40 [110121.667733][ C7] __mutex_lock+0x408/0xdac [110121.667741][ C7] __mutex_lock_slowpath+0x14/0x24 [110121.667748][ C7] mutex_lock+0x40/0xec [110121.667757][ C7] tcpm_altmode_enter+0x78/0xb4 [110121.667764][ C7] typec_altmode_enter+0xdc/0x10c [110121.667769][ C7] dp_altmode_work+0x68/0x164 [110121.667775][ C7] process_one_work+0x1e4/0x43c [110121.667783][ C7] worker_thread+0x25c/0x430 [110121.667789][ C7] kthread+0x104/0x1d4 [110121.667794][ C7] ret_from_fork+0x10/0x20
Change tcpm_queue_vdm_unlocked to queue for tcpm_queue_vdm_work, which can perform the state check while holding the TCPM lock while the Alt Mode lock is no longer held. This requires a new struct to hold the vdm data, altmode_vdm_event.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 14, 2025 | Jul 10, 2025 |
| Suse | — | Upgrade dtb-amlogicUpgrade dtb-lgUpgrade cluster-md-kmp-defaultUpgrade kernel-macrosUpgrade kernel-docs-htmlUpgrade kernel-kvmsmall-develUpgrade dtb-marvellUpgrade kernel-syms-azureUpgrade dtb-broadcomUpgrade kernel-azure-develUpgrade kernel-zfcpdumpUpgrade gfs2-kmp-rtUpgrade kernel-kvmsmallUpgrade kernel-sourceUpgrade kernel-devel-azureUpgrade kernel-default-livepatchUpgrade dtb-appleUpgrade dtb-apmUpgrade kernel-default-develUpgrade dtb-amazonUpgrade kernel-64kb-optionalUpgrade kselftests-kmp-64kbUpgrade dtb-freescaleUpgrade kernel-source-azureUpgrade dtb-qcomUpgrade dtb-exynosUpgrade dtb-hisiliconUpgrade ocfs2-kmp-64kbUpgrade kernel-64kbUpgrade kernel-obs-qaUpgrade gfs2-kmp-64kbUpgrade cluster-md-kmp-rtUpgrade ocfs2-kmp-rtUpgrade dtb-xilinxUpgrade dtb-alteraUpgrade kernel-64kb-develUpgrade kernel-symsUpgrade kernel-default-optionalUpgrade kernel-default-vdsoUpgrade kernel-default-extraUpgrade kernel-rt-livepatchUpgrade kernel-rt-livepatch-develUpgrade kernel-rtUpgrade dlm-kmp-64kbUpgrade kselftests-kmp-rtUpgrade dtb-caviumUpgrade kernel-rt-extraUpgrade kernel-64kb-extraUpgrade kernel-default-baseUpgrade ocfs2-kmp-defaultUpgrade dlm-kmp-defaultUpgrade dlm-kmp-rtUpgrade kernel-rt-optionalUpgrade kernel-docsUpgrade dtb-nvidiaUpgrade dtb-sprdUpgrade kernel-kvmsmall-vdsoUpgrade dtb-armUpgrade kernel-rt-develUpgrade kernel-azureUpgrade dtb-socionextUpgrade dtb-renesasUpgrade kernel-develUpgrade kernel-rt-vdsoUpgrade kernel-defaultUpgrade dtb-rockchipUpgrade dtb-allwinnerUpgrade kernel-obs-buildUpgrade kernel-source-vanillaUpgrade gfs2-kmp-defaultUpgrade dtb-mediatekUpgrade cluster-md-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade dtb-amdUpgrade reiserfs-kmp-defaultUpgrade kselftests-kmp-default | Dec 5, 2025 | Aug 18, 2025 |
| Ubuntu | — | Upgrade linux-image-raspi-6.14Upgrade linux-image-realtimeUpgrade linux-image-oracle-64kUpgrade linux-image-6.14.0-1013-awsUpgrade linux-image-6.14.0-1013-oracle-64kUpgrade linux-image-6.14.0-1012-oemUpgrade linux-image-gcpUpgrade linux-image-6.14.0-1012-realtimeUpgrade linux-image-gcp-6.14Upgrade linux-image-raspiUpgrade linux-image-aws-64k-6.14Upgrade linux-image-awsUpgrade linux-image-gcp-64kUpgrade linux-image-6.14.0-1013-aws-64kUpgrade linux-image-aws-64kUpgrade linux-image-realtime-6.14Upgrade linux-image-oracleUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-virtual-6.14Upgrade linux-image-6.14.0-32-genericUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-oem-24.04aUpgrade linux-image-oem-24.04cUpgrade linux-image-generic-64k-6.14Upgrade linux-image-aws-6.14Upgrade linux-image-azureUpgrade linux-image-6.14.0-1012-azureUpgrade linux-image-6.14.0-1013-oracleUpgrade linux-image-generic-6.14Upgrade linux-image-6.14.0-1014-raspiUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-oem-24.04bUpgrade linux-image-6.14.0-1016-gcpUpgrade linux-image-6.14.0-32-generic-64kUpgrade linux-image-oracle-6.14Upgrade linux-image-genericUpgrade linux-image-azure-6.14Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-virtualUpgrade linux-image-generic-64kUpgrade linux-image-oem-24.04Upgrade linux-image-oem-6.14Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.14.0-1016-gcp-64k | Jul 14, 2025 | Jul 10, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub