CVE-2025-38268 (GCVE-0-2025-38268)
Vulnerability from cvelistv5
Published
2025-07-10 07:41
Modified
2025-07-28 04:16
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work A state check was previously added to tcpm_queue_vdm_unlocked to prevent a deadlock where the DisplayPort Alt Mode driver would be executing work and attempting to grab the tcpm_lock while the TCPM was holding the lock and attempting to unregister the altmode, blocking on the altmode driver's cancel_work_sync call. Because the state check isn't protected, there is a small window where the Alt Mode driver could determine that the TCPM is in a ready state and attempt to grab the lock while the TCPM grabs the lock and changes the TCPM state to one that causes the deadlock. The callstack is provided below: [110121.667392][ C7] Call trace: [110121.667396][ C7] __switch_to+0x174/0x338 [110121.667406][ C7] __schedule+0x608/0x9f0 [110121.667414][ C7] schedule+0x7c/0xe8 [110121.667423][ C7] kernfs_drain+0xb0/0x114 [110121.667431][ C7] __kernfs_remove+0x16c/0x20c [110121.667436][ C7] kernfs_remove_by_name_ns+0x74/0xe8 [110121.667442][ C7] sysfs_remove_group+0x84/0xe8 [110121.667450][ C7] sysfs_remove_groups+0x34/0x58 [110121.667458][ C7] device_remove_groups+0x10/0x20 [110121.667464][ C7] device_release_driver_internal+0x164/0x2e4 [110121.667475][ C7] device_release_driver+0x18/0x28 [110121.667484][ C7] bus_remove_device+0xec/0x118 [110121.667491][ C7] device_del+0x1e8/0x4ac [110121.667498][ C7] device_unregister+0x18/0x38 [110121.667504][ C7] typec_unregister_altmode+0x30/0x44 [110121.667515][ C7] tcpm_reset_port+0xac/0x370 [110121.667523][ C7] tcpm_snk_detach+0x84/0xb8 [110121.667529][ C7] run_state_machine+0x4c0/0x1b68 [110121.667536][ C7] tcpm_state_machine_work+0x94/0xe4 [110121.667544][ C7] kthread_worker_fn+0x10c/0x244 [110121.667552][ C7] kthread+0x104/0x1d4 [110121.667557][ C7] ret_from_fork+0x10/0x20 [110121.667689][ C7] Workqueue: events dp_altmode_work [110121.667697][ C7] Call trace: [110121.667701][ C7] __switch_to+0x174/0x338 [110121.667710][ C7] __schedule+0x608/0x9f0 [110121.667717][ C7] schedule+0x7c/0xe8 [110121.667725][ C7] schedule_preempt_disabled+0x24/0x40 [110121.667733][ C7] __mutex_lock+0x408/0xdac [110121.667741][ C7] __mutex_lock_slowpath+0x14/0x24 [110121.667748][ C7] mutex_lock+0x40/0xec [110121.667757][ C7] tcpm_altmode_enter+0x78/0xb4 [110121.667764][ C7] typec_altmode_enter+0xdc/0x10c [110121.667769][ C7] dp_altmode_work+0x68/0x164 [110121.667775][ C7] process_one_work+0x1e4/0x43c [110121.667783][ C7] worker_thread+0x25c/0x430 [110121.667789][ C7] kthread+0x104/0x1d4 [110121.667794][ C7] ret_from_fork+0x10/0x20 Change tcpm_queue_vdm_unlocked to queue for tcpm_queue_vdm_work, which can perform the state check while holding the TCPM lock while the Alt Mode lock is no longer held. This requires a new struct to hold the vdm data, altmode_vdm_event.
References
Impacted products
Vendor Product Version
Linux Linux Version: cdc9946ea6377e8e214b135ccc308c5e514ba25f
Version: cdc9946ea6377e8e214b135ccc308c5e514ba25f
Version: cdc9946ea6377e8e214b135ccc308c5e514ba25f
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/typec/tcpm/tcpm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7bdd712abefbec79176ab412d8c623e755c5d0ba",
              "status": "affected",
              "version": "cdc9946ea6377e8e214b135ccc308c5e514ba25f",
              "versionType": "git"
            },
            {
              "lessThan": "1970d34b48cbeceb0c765984c9a6bb204c77f16a",
              "status": "affected",
              "version": "cdc9946ea6377e8e214b135ccc308c5e514ba25f",
              "versionType": "git"
            },
            {
              "lessThan": "324d45e53f1a36c88bc649dc39e0c8300a41be0a",
              "status": "affected",
              "version": "cdc9946ea6377e8e214b135ccc308c5e514ba25f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/typec/tcpm/tcpm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work\n\nA state check was previously added to tcpm_queue_vdm_unlocked to\nprevent a deadlock where the DisplayPort Alt Mode driver would be\nexecuting work and attempting to grab the tcpm_lock while the TCPM\nwas holding the lock and attempting to unregister the altmode, blocking\non the altmode driver\u0027s cancel_work_sync call.\n\nBecause the state check isn\u0027t protected, there is a small window\nwhere the Alt Mode driver could determine that the TCPM is\nin a ready state and attempt to grab the lock while the\nTCPM grabs the lock and changes the TCPM state to one that\ncauses the deadlock. The callstack is provided below:\n\n[110121.667392][    C7] Call trace:\n[110121.667396][    C7]  __switch_to+0x174/0x338\n[110121.667406][    C7]  __schedule+0x608/0x9f0\n[110121.667414][    C7]  schedule+0x7c/0xe8\n[110121.667423][    C7]  kernfs_drain+0xb0/0x114\n[110121.667431][    C7]  __kernfs_remove+0x16c/0x20c\n[110121.667436][    C7]  kernfs_remove_by_name_ns+0x74/0xe8\n[110121.667442][    C7]  sysfs_remove_group+0x84/0xe8\n[110121.667450][    C7]  sysfs_remove_groups+0x34/0x58\n[110121.667458][    C7]  device_remove_groups+0x10/0x20\n[110121.667464][    C7]  device_release_driver_internal+0x164/0x2e4\n[110121.667475][    C7]  device_release_driver+0x18/0x28\n[110121.667484][    C7]  bus_remove_device+0xec/0x118\n[110121.667491][    C7]  device_del+0x1e8/0x4ac\n[110121.667498][    C7]  device_unregister+0x18/0x38\n[110121.667504][    C7]  typec_unregister_altmode+0x30/0x44\n[110121.667515][    C7]  tcpm_reset_port+0xac/0x370\n[110121.667523][    C7]  tcpm_snk_detach+0x84/0xb8\n[110121.667529][    C7]  run_state_machine+0x4c0/0x1b68\n[110121.667536][    C7]  tcpm_state_machine_work+0x94/0xe4\n[110121.667544][    C7]  kthread_worker_fn+0x10c/0x244\n[110121.667552][    C7]  kthread+0x104/0x1d4\n[110121.667557][    C7]  ret_from_fork+0x10/0x20\n\n[110121.667689][    C7] Workqueue: events dp_altmode_work\n[110121.667697][    C7] Call trace:\n[110121.667701][    C7]  __switch_to+0x174/0x338\n[110121.667710][    C7]  __schedule+0x608/0x9f0\n[110121.667717][    C7]  schedule+0x7c/0xe8\n[110121.667725][    C7]  schedule_preempt_disabled+0x24/0x40\n[110121.667733][    C7]  __mutex_lock+0x408/0xdac\n[110121.667741][    C7]  __mutex_lock_slowpath+0x14/0x24\n[110121.667748][    C7]  mutex_lock+0x40/0xec\n[110121.667757][    C7]  tcpm_altmode_enter+0x78/0xb4\n[110121.667764][    C7]  typec_altmode_enter+0xdc/0x10c\n[110121.667769][    C7]  dp_altmode_work+0x68/0x164\n[110121.667775][    C7]  process_one_work+0x1e4/0x43c\n[110121.667783][    C7]  worker_thread+0x25c/0x430\n[110121.667789][    C7]  kthread+0x104/0x1d4\n[110121.667794][    C7]  ret_from_fork+0x10/0x20\n\nChange tcpm_queue_vdm_unlocked to queue for tcpm_queue_vdm_work,\nwhich can perform the state check while holding the TCPM lock\nwhile the Alt Mode lock is no longer held. This requires a new\nstruct to hold the vdm data, altmode_vdm_event."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-28T04:16:48.451Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7bdd712abefbec79176ab412d8c623e755c5d0ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/1970d34b48cbeceb0c765984c9a6bb204c77f16a"
        },
        {
          "url": "https://git.kernel.org/stable/c/324d45e53f1a36c88bc649dc39e0c8300a41be0a"
        }
      ],
      "title": "usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38268",
    "datePublished": "2025-07-10T07:41:51.217Z",
    "dateReserved": "2025-04-16T04:51:23.998Z",
    "dateUpdated": "2025-07-28T04:16:48.451Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38268\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-10T08:15:24.963\",\"lastModified\":\"2025-07-10T13:17:30.017\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work\\n\\nA state check was previously added to tcpm_queue_vdm_unlocked to\\nprevent a deadlock where the DisplayPort Alt Mode driver would be\\nexecuting work and attempting to grab the tcpm_lock while the TCPM\\nwas holding the lock and attempting to unregister the altmode, blocking\\non the altmode driver\u0027s cancel_work_sync call.\\n\\nBecause the state check isn\u0027t protected, there is a small window\\nwhere the Alt Mode driver could determine that the TCPM is\\nin a ready state and attempt to grab the lock while the\\nTCPM grabs the lock and changes the TCPM state to one that\\ncauses the deadlock. The callstack is provided below:\\n\\n[110121.667392][    C7] Call trace:\\n[110121.667396][    C7]  __switch_to+0x174/0x338\\n[110121.667406][    C7]  __schedule+0x608/0x9f0\\n[110121.667414][    C7]  schedule+0x7c/0xe8\\n[110121.667423][    C7]  kernfs_drain+0xb0/0x114\\n[110121.667431][    C7]  __kernfs_remove+0x16c/0x20c\\n[110121.667436][    C7]  kernfs_remove_by_name_ns+0x74/0xe8\\n[110121.667442][    C7]  sysfs_remove_group+0x84/0xe8\\n[110121.667450][    C7]  sysfs_remove_groups+0x34/0x58\\n[110121.667458][    C7]  device_remove_groups+0x10/0x20\\n[110121.667464][    C7]  device_release_driver_internal+0x164/0x2e4\\n[110121.667475][    C7]  device_release_driver+0x18/0x28\\n[110121.667484][    C7]  bus_remove_device+0xec/0x118\\n[110121.667491][    C7]  device_del+0x1e8/0x4ac\\n[110121.667498][    C7]  device_unregister+0x18/0x38\\n[110121.667504][    C7]  typec_unregister_altmode+0x30/0x44\\n[110121.667515][    C7]  tcpm_reset_port+0xac/0x370\\n[110121.667523][    C7]  tcpm_snk_detach+0x84/0xb8\\n[110121.667529][    C7]  run_state_machine+0x4c0/0x1b68\\n[110121.667536][    C7]  tcpm_state_machine_work+0x94/0xe4\\n[110121.667544][    C7]  kthread_worker_fn+0x10c/0x244\\n[110121.667552][    C7]  kthread+0x104/0x1d4\\n[110121.667557][    C7]  ret_from_fork+0x10/0x20\\n\\n[110121.667689][    C7] Workqueue: events dp_altmode_work\\n[110121.667697][    C7] Call trace:\\n[110121.667701][    C7]  __switch_to+0x174/0x338\\n[110121.667710][    C7]  __schedule+0x608/0x9f0\\n[110121.667717][    C7]  schedule+0x7c/0xe8\\n[110121.667725][    C7]  schedule_preempt_disabled+0x24/0x40\\n[110121.667733][    C7]  __mutex_lock+0x408/0xdac\\n[110121.667741][    C7]  __mutex_lock_slowpath+0x14/0x24\\n[110121.667748][    C7]  mutex_lock+0x40/0xec\\n[110121.667757][    C7]  tcpm_altmode_enter+0x78/0xb4\\n[110121.667764][    C7]  typec_altmode_enter+0xdc/0x10c\\n[110121.667769][    C7]  dp_altmode_work+0x68/0x164\\n[110121.667775][    C7]  process_one_work+0x1e4/0x43c\\n[110121.667783][    C7]  worker_thread+0x25c/0x430\\n[110121.667789][    C7]  kthread+0x104/0x1d4\\n[110121.667794][    C7]  ret_from_fork+0x10/0x20\\n\\nChange tcpm_queue_vdm_unlocked to queue for tcpm_queue_vdm_work,\\nwhich can perform the state check while holding the TCPM lock\\nwhile the Alt Mode lock is no longer held. This requires a new\\nstruct to hold the vdm data, altmode_vdm_event.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: typec: tcpm: mover tcpm_queue_vdm_unlocked a trabajo as\u00edncrono Anteriormente se agreg\u00f3 una comprobaci\u00f3n de estado a tcpm_queue_vdm_unlocked para evitar un interbloqueo donde el controlador de modo alternativo de DisplayPort estar\u00eda ejecutando trabajo e intentando agarrar el tcpm_lock mientras que TCPM manten\u00eda el bloqueo e intentaba anular el registro del modo alternativo, bloqueando la llamada cancel_work_sync del controlador del modo alternativo. Debido a que la comprobaci\u00f3n de estado no est\u00e1 protegida, hay una peque\u00f1a ventana donde el controlador del modo alternativo podr\u00eda determinar que TCPM est\u00e1 en un estado listo e intentar agarrar el bloqueo mientras TCPM toma el bloqueo y cambia el estado de TCPM a uno que causa el interbloqueo. La pila de llamadas se proporciona a continuaci\u00f3n: [110121.667392][ C7] Rastreo de llamadas: [110121.667396][ C7] __switch_to+0x174/0x338 [110121.667406][ C7] __schedule+0x608/0x9f0 [110121.667414][ C7] schedule+0x7c/0xe8 [110121.667423][ C7] kernfs_drain+0xb0/0x114 [110121.667431][ C7] __kernfs_remove+0x16c/0x20c [110121.667436][ C7] kernfs_remove_by_name_ns+0x74/0xe8 [110121.667442][ C7] sysfs_remove_group+0x84/0xe8 [110121.667450][ C7] sysfs_remove_groups+0x34/0x58 [110121.667458][ C7] device_remove_groups+0x10/0x20 [110121.667464][ C7] device_release_driver_internal+0x164/0x2e4 [110121.667475][ C7] device_release_driver+0x18/0x28 [110121.667484][ C7] bus_remove_device+0xec/0x118 [110121.667491][ C7] device_del+0x1e8/0x4ac [110121.667498][ C7] device_unregister+0x18/0x38 [110121.667504][ C7] typec_unregister_altmode+0x30/0x44 [110121.667515][ C7] tcpm_reset_port+0xac/0x370 [110121.667523][ C7] tcpm_snk_detach+0x84/0xb8 [110121.667529][ C7] run_state_machine+0x4c0/0x1b68 [110121.667536][ C7] tcpm_state_machine_work+0x94/0xe4 [110121.667544][ C7] kthread_worker_fn+0x10c/0x244 [110121.667552][ C7] kthread+0x104/0x1d4 [110121.667557][ C7] ret_from_fork+0x10/0x20 [110121.667689][ C7] Workqueue: events dp_altmode_work [110121.667697][ C7] Call trace: [110121.667701][ C7] __switch_to+0x174/0x338 [110121.667710][ C7] __schedule+0x608/0x9f0 [110121.667717][ C7] schedule+0x7c/0xe8 [110121.667725][ C7] schedule_preempt_disabled+0x24/0x40 [110121.667733][ C7] __mutex_lock+0x408/0xdac [110121.667741][ C7] __mutex_lock_slowpath+0x14/0x24 [110121.667748][ C7] mutex_lock+0x40/0xec [110121.667757][ C7] tcpm_altmode_enter+0x78/0xb4 [110121.667764][ C7] typec_altmode_enter+0xdc/0x10c [110121.667769][ C7] dp_altmode_work+0x68/0x164 [110121.667775][ C7] process_one_work+0x1e4/0x43c [110121.667783][ C7] worker_thread+0x25c/0x430 [110121.667789][ C7] kthread+0x104/0x1d4 [110121.667794][ C7] ret_from_fork+0x10/0x20 Change tcpm_queue_vdm_unlocked to queue for tcpm_queue_vdm_work, que puede realizar la verificaci\u00f3n de estado mientras mantiene el bloqueo TCPM mientras el bloqueo del modo Alt ya no est\u00e1 activo. Esto requiere una nueva estructura para almacenar los datos de VDM: altmode_vdm_event.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1970d34b48cbeceb0c765984c9a6bb204c77f16a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/324d45e53f1a36c88bc649dc39e0c8300a41be0a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7bdd712abefbec79176ab412d8c623e755c5d0ba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.