{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"c93bc959788ed9a1af7df57cb539837bdf790cee","status":"affected","version":"0e3bb7d6894d9b6e67d6382bb03a46a1dc989588","versionType":"git"},{"lessThan":"114a977e0f6bf278e05eade055e13fc271f69cf7","status":"affected","version":"0e3bb7d6894d9b6e67d6382bb03a46a1dc989588","versionType":"git"},{"lessThan":"621d5a3ef0231ab242f2d31eecec40c38ca609c5","status":"affected","version":"0e3bb7d6894d9b6e67d6382bb03a46a1dc989588","versionType":"git"},{"lessThan":"2f535517b5611b7221ed478527e4b58e29536ddf","status":"affected","version":"0e3bb7d6894d9b6e67d6382bb03a46a1dc989588","versionType":"git"},{"lessThan":"45e9444b3b97eaf51a5024f1fea92f44f39b50c6","status":"affected","version":"0e3bb7d6894d9b6e67d6382bb03a46a1dc989588","versionType":"git"},{"lessThan":"5581e694d3a1c2f32c5a51d745c55b107644e1f8","status":"affected","version":"0e3bb7d6894d9b6e67d6382bb03a46a1dc989588","versionType":"git"},{"lessThan":"47cb5d26f61d80c805d7de4106451153779297a1","status":"affected","version":"0e3bb7d6894d9b6e67d6382bb03a46a1dc989588","versionType":"git"},{"lessThan":"af4db5a35a4ef7a68046883bfd12468007db38f1","status":"affected","version":"0e3bb7d6894d9b6e67d6382bb03a46a1dc989588","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"4.19"},{"lessThan":"4.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.296","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.240","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.187","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.144","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.97","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.37","versionType":"semver"},{"lessThanOrEqual":"6.15.*","status":"unaffected","version":"6.15.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.16","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2025-38391","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: altmodes/displayport: do not index invalid pin_assignments\n\nA poorly implemented DisplayPort Alt Mode port partner can indicate\nthat its pin assignment capabilities are greater than the maximum\nvalue, DP_PIN_ASSIGN_F. In this case, calls to pin_assignment_show\nwill cause a BRK exception due to an out of bounds array access.\n\nPrevent for loop in pin_assignment_show from accessing\ninvalid values in pin_assignments by adding DP_PIN_ASSIGN_MAX\nvalue in typec_dp.h and using i < DP_PIN_ASSIGN_MAX as a loop\ncondition.","epss":{"date":"2026-11-05","percentile":0.11284,"score":0.0021},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793912556304,"publishedAt":1753448011223,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/c93bc959788ed9a1af7df57cb539837bdf790cee"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/114a977e0f6bf278e05eade055e13fc271f69cf7"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/621d5a3ef0231ab242f2d31eecec40c38ca609c5"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/2f535517b5611b7221ed478527e4b58e29536ddf"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/45e9444b3b97eaf51a5024f1fea92f44f39b50c6"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/5581e694d3a1c2f32c5a51d745c55b107644e1f8"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/47cb5d26f61d80c805d7de4106451153779297a1"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/af4db5a35a4ef7a68046883bfd12468007db38f1"},{"source":"ADP: CVE","tags":[],"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"},{"source":"ADP: CVE","tags":[],"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}],"remediation":[],"revision":"c017b1a060c5b98a3064f7c2a564cb20784df05f211ddfe830f9c9d65d3db34a","sources":[{"modifiedAt":1793912556304,"name":"CNA: Linux","retrievedAt":1793913683327,"url":"https://www.cve.org/CVERecord?id=CVE-2025-38391"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793913705907,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-38391"}],"ssvc":{"assessedAt":1793912155581,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"usb: typec: altmodes/displayport: do not index invalid pin_assignments","updatedAt":1793913705907}