In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work
A state check was previously added to tcpm_queue_vdm_unlocked to prevent a deadlock where the DisplayPort Alt Mode driver would be executing work and attempting to grab the tcpm_lock while the TCPM was holding the lock and attempting to unregister the altmode, blocking on the altmode driver's cancel_work_sync call.
Because the state check isn't protected, there is a small window where the Alt Mode driver could determine that the TCPM is in a ready state and attempt to grab the lock while the TCPM grabs the lock and changes the TCPM state to one that causes the deadlock. The callstack is provided below:
[110121.667392][ C7] Call trace: [110121.667396][ C7] __switch_to+0x174/0x338 [110121.667406][ C7] __schedule+0x608/0x9f0 [110121.667414][ C7] schedule+0x7c/0xe8 [110121.667423][ C7] kernfs_drain+0xb0/0x114 [110121.667431][ C7] __kernfs_remove+0x16c/0x20c [110121.667436][ C7] kernfs_remove_by_name_ns+0x74/0xe8 [110121.667442][ C7] sysfs_remove_group+0x84/0xe8 [110121.667450][ C7] sysfs_remove_groups+0x34/0x58 [110121.667458][ C7] device_remove_groups+0x10/0x20 [110121.667464][ C7] device_release_driver_internal+0x164/0x2e4 [110121.667475][ C7] device_release_driver+0x18/0x28 [110121.667484][ C7] bus_remove_device+0xec/0x118 [110121.667491][ C7] device_del+0x1e8/0x4ac [110121.667498][ C7] device_unregister+0x18/0x38 [110121.667504][ C7] typec_unregister_altmode+0x30/0x44 [110121.667515][ C7] tcpm_reset_port+0xac/0x370 [110121.667523][ C7] tcpm_snk_detach+0x84/0xb8 [110121.667529][ C7] run_state_machine+0x4c0/0x1b68 [110121.667536][ C7] tcpm_state_machine_work+0x94/0xe4 [110121.667544][ C7] kthread_worker_fn+0x10c/0x244 [110121.667552][ C7] kthread+0x104/0x1d4 [110121.667557][ C7] ret_from_fork+0x10/0x20
[110121.667689][ C7] Workqueue: events dp_altmode_work [110121.667697][ C7] Call trace: [110121.667701][ C7] __switch_to+0x174/0x338 [110121.667710][ C7] __schedule+0x608/0x9f0 [110121.667717][ C7] schedule+0x7c/0xe8 [110121.667725][ C7] schedule_preempt_disabled+0x24/0x40 [110121.667733][ C7] __mutex_lock+0x408/0xdac [110121.667741][ C7] __mutex_lock_slowpath+0x14/0x24 [110121.667748][ C7] mutex_lock+0x40/0xec [110121.667757][ C7] tcpm_altmode_enter+0x78/0xb4 [110121.667764][ C7] typec_altmode_enter+0xdc/0x10c [110121.667769][ C7] dp_altmode_work+0x68/0x164 [110121.667775][ C7] process_one_work+0x1e4/0x43c [110121.667783][ C7] worker_thread+0x25c/0x430 [110121.667789][ C7] kthread+0x104/0x1d4 [110121.667794][ C7] ret_from_fork+0x10/0x20
Change tcpm_queue_vdm_unlocked to queue for tcpm_queue_vdm_work, which can perform the state check while holding the TCPM lock while the Alt Mode lock is no longer held. This requires a new struct to hold the vdm data, altmode_vdm_event.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 14, 2025 | Jul 10, 2025 |
| Suse | — | Upgrade dlm-kmp-defaultUpgrade dlm-kmp-rtUpgrade kernel-docsUpgrade dtb-caviumUpgrade kernel-64kb-extraUpgrade kselftests-kmp-rtUpgrade kernel-default-baseUpgrade kernel-obs-buildUpgrade kernel-rt-vdsoUpgrade gfs2-kmp-defaultUpgrade kernel-rt-extraUpgrade kernel-defaultUpgrade dtb-nvidiaUpgrade kernel-rt-develUpgrade kernel-source-vanillaUpgrade kernel-azureUpgrade kernel-develUpgrade dtb-renesasUpgrade dtb-armUpgrade dtb-socionextUpgrade dtb-allwinnerUpgrade kernel-default-livepatch-develUpgrade cluster-md-kmp-64kbUpgrade kernel-kvmsmall-vdsoUpgrade dtb-mediatekUpgrade dtb-sprdUpgrade dtb-rockchipUpgrade kernel-rt-optionalUpgrade ocfs2-kmp-defaultUpgrade dtb-amdUpgrade kselftests-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade dtb-exynosUpgrade dtb-lgUpgrade dtb-broadcomUpgrade kernel-kvmsmall-develUpgrade kernel-docs-htmlUpgrade kernel-symsUpgrade kernel-default-vdsoUpgrade dtb-alteraUpgrade kernel-64kb-develUpgrade dtb-xilinxUpgrade dtb-hisiliconUpgrade kernel-default-extraUpgrade kernel-obs-qaUpgrade ocfs2-kmp-rtUpgrade kernel-64kb-optionalUpgrade dtb-freescaleUpgrade kernel-kvmsmallUpgrade kernel-devel-azureUpgrade gfs2-kmp-64kbUpgrade dtb-qcomUpgrade dtb-appleUpgrade kernel-zfcpdumpUpgrade gfs2-kmp-rtUpgrade cluster-md-kmp-rtUpgrade kernel-default-livepatchUpgrade kernel-azure-develUpgrade dtb-marvellUpgrade kernel-syms-azureUpgrade kernel-sourceUpgrade kernel-default-optionalUpgrade cluster-md-kmp-defaultUpgrade kernel-macrosUpgrade dtb-amlogicUpgrade kernel-default-develUpgrade dtb-amazonUpgrade kselftests-kmp-64kbUpgrade kernel-source-azureUpgrade dtb-apmUpgrade kernel-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-64kbUpgrade dlm-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-livepatch | Dec 5, 2025 | Aug 18, 2025 |
| Ubuntu | — | Upgrade linux-image-virtual-6.14Upgrade linux-image-6.14.0-1014-raspiUpgrade linux-image-gcp-64kUpgrade linux-image-6.14.0-1012-realtimeUpgrade linux-image-generic-6.14Upgrade linux-image-realtime-6.14Upgrade linux-image-aws-64k-6.14Upgrade linux-image-6.14.0-1013-oracleUpgrade linux-image-azureUpgrade linux-image-generic-64k-6.14Upgrade linux-image-6.14.0-1012-oemUpgrade linux-image-raspi-6.14Upgrade linux-image-gcpUpgrade linux-image-oracle-64kUpgrade linux-image-realtimeUpgrade linux-image-oem-24.04aUpgrade linux-image-6.14.0-1013-aws-64kUpgrade linux-image-awsUpgrade linux-image-raspiUpgrade linux-image-aws-6.14Upgrade linux-image-6.14.0-1013-awsUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-gcp-6.14Upgrade linux-image-aws-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-oem-24.04cUpgrade linux-image-6.14.0-1013-oracle-64kUpgrade linux-image-oracleUpgrade linux-image-6.14.0-32-genericUpgrade linux-image-6.14.0-1012-azureUpgrade linux-image-genericUpgrade linux-image-6.14.0-32-generic-64kUpgrade linux-image-virtualUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-generic-64kUpgrade linux-image-oem-24.04Upgrade linux-image-6.14.0-1016-gcp-64kUpgrade linux-image-oem-6.14Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-oem-24.04bUpgrade linux-image-6.14.0-1016-gcpUpgrade linux-image-oracle-6.14Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-azure-6.14 | Jul 14, 2025 | Jul 10, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub