In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work
A state check was previously added to tcpm_queue_vdm_unlocked to prevent a deadlock where the DisplayPort Alt Mode driver would be executing work and attempting to grab the tcpm_lock while the TCPM was holding the lock and attempting to unregister the altmode, blocking on the altmode driver's cancel_work_sync call.
Because the state check isn't protected, there is a small window where the Alt Mode driver could determine that the TCPM is in a ready state and attempt to grab the lock while the TCPM grabs the lock and changes the TCPM state to one that causes the deadlock. The callstack is provided below:
[110121.667392][ C7] Call trace: [110121.667396][ C7] __switch_to+0x174/0x338 [110121.667406][ C7] __schedule+0x608/0x9f0 [110121.667414][ C7] schedule+0x7c/0xe8 [110121.667423][ C7] kernfs_drain+0xb0/0x114 [110121.667431][ C7] __kernfs_remove+0x16c/0x20c [110121.667436][ C7] kernfs_remove_by_name_ns+0x74/0xe8 [110121.667442][ C7] sysfs_remove_group+0x84/0xe8 [110121.667450][ C7] sysfs_remove_groups+0x34/0x58 [110121.667458][ C7] device_remove_groups+0x10/0x20 [110121.667464][ C7] device_release_driver_internal+0x164/0x2e4 [110121.667475][ C7] device_release_driver+0x18/0x28 [110121.667484][ C7] bus_remove_device+0xec/0x118 [110121.667491][ C7] device_del+0x1e8/0x4ac [110121.667498][ C7] device_unregister+0x18/0x38 [110121.667504][ C7] typec_unregister_altmode+0x30/0x44 [110121.667515][ C7] tcpm_reset_port+0xac/0x370 [110121.667523][ C7] tcpm_snk_detach+0x84/0xb8 [110121.667529][ C7] run_state_machine+0x4c0/0x1b68 [110121.667536][ C7] tcpm_state_machine_work+0x94/0xe4 [110121.667544][ C7] kthread_worker_fn+0x10c/0x244 [110121.667552][ C7] kthread+0x104/0x1d4 [110121.667557][ C7] ret_from_fork+0x10/0x20
[110121.667689][ C7] Workqueue: events dp_altmode_work [110121.667697][ C7] Call trace: [110121.667701][ C7] __switch_to+0x174/0x338 [110121.667710][ C7] __schedule+0x608/0x9f0 [110121.667717][ C7] schedule+0x7c/0xe8 [110121.667725][ C7] schedule_preempt_disabled+0x24/0x40 [110121.667733][ C7] __mutex_lock+0x408/0xdac [110121.667741][ C7] __mutex_lock_slowpath+0x14/0x24 [110121.667748][ C7] mutex_lock+0x40/0xec [110121.667757][ C7] tcpm_altmode_enter+0x78/0xb4 [110121.667764][ C7] typec_altmode_enter+0xdc/0x10c [110121.667769][ C7] dp_altmode_work+0x68/0x164 [110121.667775][ C7] process_one_work+0x1e4/0x43c [110121.667783][ C7] worker_thread+0x25c/0x430 [110121.667789][ C7] kthread+0x104/0x1d4 [110121.667794][ C7] ret_from_fork+0x10/0x20
Change tcpm_queue_vdm_unlocked to queue for tcpm_queue_vdm_work, which can perform the state check while holding the TCPM lock while the Alt Mode lock is no longer held. This requires a new struct to hold the vdm data, altmode_vdm_event.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 14, 2025 | Jul 10, 2025 |
| Suse | — | Upgrade kernel-kvmsmall-develUpgrade kernel-rt-livepatchUpgrade kernel-docs-htmlUpgrade kernel-rt-livepatch-develUpgrade kernel-symsUpgrade dtb-amlogicUpgrade dtb-lgUpgrade dtb-amazonUpgrade dtb-apmUpgrade kernel-source-azureUpgrade kernel-macrosUpgrade kselftests-kmp-64kbUpgrade kernel-rtUpgrade kernel-default-develUpgrade dtb-marvellUpgrade dtb-exynosUpgrade dtb-hisiliconUpgrade kernel-64kbUpgrade ocfs2-kmp-64kbUpgrade cluster-md-kmp-defaultUpgrade kernel-default-optionalUpgrade dlm-kmp-64kbUpgrade kernel-default-extraUpgrade kernel-devel-azureUpgrade cluster-md-kmp-rtUpgrade gfs2-kmp-rtUpgrade dtb-appleUpgrade kernel-kvmsmallUpgrade kernel-obs-qaUpgrade kernel-azure-develUpgrade kernel-zfcpdumpUpgrade dtb-qcomUpgrade dtb-freescaleUpgrade kernel-64kb-optionalUpgrade kernel-syms-azureUpgrade gfs2-kmp-64kbUpgrade kernel-default-vdsoUpgrade ocfs2-kmp-rtUpgrade dtb-alteraUpgrade dtb-broadcomUpgrade kernel-sourceUpgrade kernel-default-livepatchUpgrade dtb-xilinxUpgrade kernel-64kb-develUpgrade kernel-develUpgrade gfs2-kmp-defaultUpgrade kernel-rt-vdsoUpgrade kernel-obs-buildUpgrade kernel-source-vanillaUpgrade dtb-amdUpgrade kernel-kvmsmall-vdsoUpgrade dtb-sprdUpgrade dtb-allwinnerUpgrade kernel-docsUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-optionalUpgrade kselftests-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade dlm-kmp-rtUpgrade dlm-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade kernel-64kb-extraUpgrade kselftests-kmp-rtUpgrade kernel-default-baseUpgrade dtb-mediatekUpgrade kernel-default-livepatch-develUpgrade kernel-rt-develUpgrade dtb-renesasUpgrade kernel-azureUpgrade dtb-armUpgrade dtb-socionextUpgrade dtb-caviumUpgrade kernel-rt-extraUpgrade dtb-nvidiaUpgrade kernel-defaultUpgrade dtb-rockchip | Dec 5, 2025 | Aug 18, 2025 |
| Ubuntu | — | Upgrade linux-image-oracleUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.14.0-32-genericUpgrade linux-image-oem-24.04cUpgrade linux-image-aws-64kUpgrade linux-image-6.14.0-1013-oracle-64kUpgrade linux-image-aws-64k-6.14Upgrade linux-image-raspiUpgrade linux-image-awsUpgrade linux-image-6.14.0-1012-oemUpgrade linux-image-realtimeUpgrade linux-image-generic-64k-6.14Upgrade linux-image-oracle-64kUpgrade linux-image-gcpUpgrade linux-image-6.14.0-1013-awsUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.14.0-1012-realtimeUpgrade linux-image-azureUpgrade linux-image-gcp-6.14Upgrade linux-image-raspi-6.14Upgrade linux-image-gcp-64kUpgrade linux-image-generic-6.14Upgrade linux-image-aws-6.14Upgrade linux-image-6.14.0-1013-aws-64kUpgrade linux-image-realtime-6.14Upgrade linux-image-6.14.0-1014-raspiUpgrade linux-image-6.14.0-1012-azureUpgrade linux-image-6.14.0-1013-oracleUpgrade linux-image-oem-24.04aUpgrade linux-image-virtual-6.14Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-genericUpgrade linux-image-azure-6.14Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oem-24.04Upgrade linux-image-6.14.0-1016-gcp-64kUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-virtualUpgrade linux-image-generic-64kUpgrade linux-image-6.14.0-32-generic-64kUpgrade linux-image-oem-24.04bUpgrade linux-image-6.14.0-1016-gcpUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-oem-6.14Upgrade linux-image-oracle-6.14 | Jul 14, 2025 | Jul 10, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub