In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work
A state check was previously added to tcpm_queue_vdm_unlocked to prevent a deadlock where the DisplayPort Alt Mode driver would be executing work and attempting to grab the tcpm_lock while the TCPM was holding the lock and attempting to unregister the altmode, blocking on the altmode driver's cancel_work_sync call.
Because the state check isn't protected, there is a small window where the Alt Mode driver could determine that the TCPM is in a ready state and attempt to grab the lock while the TCPM grabs the lock and changes the TCPM state to one that causes the deadlock. The callstack is provided below:
[110121.667392][ C7] Call trace: [110121.667396][ C7] __switch_to+0x174/0x338 [110121.667406][ C7] __schedule+0x608/0x9f0 [110121.667414][ C7] schedule+0x7c/0xe8 [110121.667423][ C7] kernfs_drain+0xb0/0x114 [110121.667431][ C7] __kernfs_remove+0x16c/0x20c [110121.667436][ C7] kernfs_remove_by_name_ns+0x74/0xe8 [110121.667442][ C7] sysfs_remove_group+0x84/0xe8 [110121.667450][ C7] sysfs_remove_groups+0x34/0x58 [110121.667458][ C7] device_remove_groups+0x10/0x20 [110121.667464][ C7] device_release_driver_internal+0x164/0x2e4 [110121.667475][ C7] device_release_driver+0x18/0x28 [110121.667484][ C7] bus_remove_device+0xec/0x118 [110121.667491][ C7] device_del+0x1e8/0x4ac [110121.667498][ C7] device_unregister+0x18/0x38 [110121.667504][ C7] typec_unregister_altmode+0x30/0x44 [110121.667515][ C7] tcpm_reset_port+0xac/0x370 [110121.667523][ C7] tcpm_snk_detach+0x84/0xb8 [110121.667529][ C7] run_state_machine+0x4c0/0x1b68 [110121.667536][ C7] tcpm_state_machine_work+0x94/0xe4 [110121.667544][ C7] kthread_worker_fn+0x10c/0x244 [110121.667552][ C7] kthread+0x104/0x1d4 [110121.667557][ C7] ret_from_fork+0x10/0x20
[110121.667689][ C7] Workqueue: events dp_altmode_work [110121.667697][ C7] Call trace: [110121.667701][ C7] __switch_to+0x174/0x338 [110121.667710][ C7] __schedule+0x608/0x9f0 [110121.667717][ C7] schedule+0x7c/0xe8 [110121.667725][ C7] schedule_preempt_disabled+0x24/0x40 [110121.667733][ C7] __mutex_lock+0x408/0xdac [110121.667741][ C7] __mutex_lock_slowpath+0x14/0x24 [110121.667748][ C7] mutex_lock+0x40/0xec [110121.667757][ C7] tcpm_altmode_enter+0x78/0xb4 [110121.667764][ C7] typec_altmode_enter+0xdc/0x10c [110121.667769][ C7] dp_altmode_work+0x68/0x164 [110121.667775][ C7] process_one_work+0x1e4/0x43c [110121.667783][ C7] worker_thread+0x25c/0x430 [110121.667789][ C7] kthread+0x104/0x1d4 [110121.667794][ C7] ret_from_fork+0x10/0x20
Change tcpm_queue_vdm_unlocked to queue for tcpm_queue_vdm_work, which can perform the state check while holding the TCPM lock while the Alt Mode lock is no longer held. This requires a new struct to hold the vdm data, altmode_vdm_event.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 14, 2025 | Jul 10, 2025 |
| Suse | — | Upgrade kernel-docsUpgrade dtb-amdUpgrade dlm-kmp-rtUpgrade kselftests-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade dtb-caviumUpgrade dtb-nvidiaUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt-extraUpgrade dtb-mediatekUpgrade dtb-sprdUpgrade kernel-default-livepatch-develUpgrade kernel-rt-optionalUpgrade kernel-develUpgrade kernel-rt-vdsoUpgrade kernel-defaultUpgrade gfs2-kmp-defaultUpgrade kernel-source-vanillaUpgrade dtb-allwinnerUpgrade cluster-md-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade kernel-64kb-extraUpgrade kernel-default-baseUpgrade kselftests-kmp-rtUpgrade dtb-armUpgrade kernel-azureUpgrade kernel-rt-develUpgrade dtb-socionextUpgrade dtb-renesasUpgrade kernel-obs-buildUpgrade dtb-rockchipUpgrade dlm-kmp-defaultUpgrade kernel-macrosUpgrade kernel-default-optionalUpgrade cluster-md-kmp-defaultUpgrade kernel-64kb-optionalUpgrade dtb-appleUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-livepatchUpgrade dtb-lgUpgrade kernel-kvmsmall-develUpgrade dtb-amlogicUpgrade kernel-symsUpgrade kernel-docs-htmlUpgrade kernel-sourceUpgrade kernel-default-livepatchUpgrade kernel-azure-develUpgrade dtb-marvellUpgrade dtb-broadcomUpgrade kernel-syms-azureUpgrade kernel-source-azureUpgrade kernel-default-develUpgrade dtb-apmUpgrade dtb-amazonUpgrade kselftests-kmp-64kbUpgrade kernel-64kb-develUpgrade kernel-rtUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmallUpgrade kernel-devel-azureUpgrade gfs2-kmp-rtUpgrade gfs2-kmp-64kbUpgrade dtb-qcomUpgrade kernel-obs-qaUpgrade dtb-exynosUpgrade ocfs2-kmp-64kbUpgrade kernel-default-extraUpgrade kernel-64kbUpgrade dtb-hisiliconUpgrade dtb-freescaleUpgrade dlm-kmp-64kbUpgrade kernel-default-vdsoUpgrade dtb-xilinxUpgrade dtb-alteraUpgrade ocfs2-kmp-rtUpgrade cluster-md-kmp-rt | Dec 5, 2025 | Aug 18, 2025 |
| Ubuntu | — | Upgrade linux-image-6.14.0-1013-awsUpgrade linux-image-generic-6.14Upgrade linux-image-realtime-6.14Upgrade linux-image-gcp-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-6.14.0-1012-realtimeUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-6.14.0-1014-raspiUpgrade linux-image-6.14.0-1013-oracle-64kUpgrade linux-image-6.14.0-1012-azureUpgrade linux-image-6.14.0-1013-oracleUpgrade linux-image-gcpUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-virtual-6.14Upgrade linux-image-aws-64kUpgrade linux-image-generic-64k-6.14Upgrade linux-image-oracleUpgrade linux-image-aws-6.14Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-gcp-6.14Upgrade linux-image-azureUpgrade linux-image-6.14.0-1012-oemUpgrade linux-image-oem-24.04cUpgrade linux-image-raspiUpgrade linux-image-oracle-64kUpgrade linux-image-raspi-6.14Upgrade linux-image-realtimeUpgrade linux-image-6.14.0-1013-aws-64kUpgrade linux-image-aws-64k-6.14Upgrade linux-image-awsUpgrade linux-image-6.14.0-32-genericUpgrade linux-image-6.14.0-32-generic-64kUpgrade linux-image-generic-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oem-24.04Upgrade linux-image-6.14.0-1016-gcp-64kUpgrade linux-image-azure-6.14Upgrade linux-image-oracle-6.14Upgrade linux-image-genericUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-6.14.0-1016-gcpUpgrade linux-image-oem-24.04bUpgrade linux-image-virtualUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-oem-6.14 | Jul 14, 2025 | Jul 10, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub