cbcvebase.
CVE-2025-38404
published 2025-07-25

CVE-2025-38404: In the Linux kernel, the following vulnerability has been resolved: usb: typec: displayport: Fix potential deadlock The deadlock can occur due to a recursive…

PriorityP418medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.13%
3.0th percentile
In the Linux kernel, the following vulnerability has been resolved: usb: typec: displayport: Fix potential deadlock The deadlock can occur due to a recursive lock acquisition of `cros_typec_altmode_data::mutex`. The call chain is as follows: 1. cros_typec_altmode_work() acquires the mutex 2. typec_altmode_vdm() -> dp_altmode_vdm() -> 3. typec_altmode_exit() -> cros_typec_altmode_exit() 4. cros_typec_altmode_exit() attempts to acquire the mutex again To prevent this, defer the `typec_altmode_exit()` call by scheduling it rather than calling it directly from within the mutex-protected context.

Affected

26 ranges· showing 25
VendorProductVersion rangeFixed in
debiandebian_linux
debianlinux< linux 6.1.147-1 (bookworm)linux 6.1.147-1 (bookworm)
debianlinux-6.1< linux 6.1.147-1 (bookworm)linux 6.1.147-1 (bookworm)
linuxlinux>= 10cc2cfd3e5d0e0ec7590c4bee8bcea10e5492c4 < c782f98eef14197affa8a7b91e6981420f109ea9c782f98eef14197affa8a7b91e6981420f109ea9
linuxlinux>= 56846793f105cf2b39ecbde4f3ae86342091f6fc < 7be0d1ea71f52595499da39cea484a895e8ed0427be0d1ea71f52595499da39cea484a895e8ed042
linuxlinux>= 6.1.143 < 6.1.1446.1.144
linuxlinux>= 6.12.36 < 6.12.376.12.37
linuxlinux>= 6.15.5 < 6.15.66.15.6
linuxlinux>= 6.6.96 < 6.6.976.6.97
linuxlinux>= 8851e40587013db00b71d4aeaae30f5fd59b0eec < 63cff9f57e86b2dc25d7487ca0118df89a66529663cff9f57e86b2dc25d7487ca0118df89a665296
linuxlinux>= 8e8a69b1f8c59f0505f8a1c0fb77191f27b75011 < 76cf1f33e7319fe74c94ac92f9814094ee8cc84b76cf1f33e7319fe74c94ac92f9814094ee8cc84b
linuxlinux>= 8f6a4fa7b663468bb304cb885b93326e025ae005 < 80c25d7916a44715338d4f8924c8e52af50d0b9f80c25d7916a44715338d4f8924c8e52af50d0b9f
linuxlinux>= b4b38ffb38c91afd4dc387608db26f6fc34ed40b < 099cf1fbb8afc3771f408109f62bdec66f85160e099cf1fbb8afc3771f408109f62bdec66f85160e
linuxlinux>= e0359c66c1beccbe90119a63391678eabda38007 < 749d9076735fb497aae60fbea9fff563f9ea3254749d9076735fb497aae60fbea9fff563f9ea3254
linuxlinux>= e3fb6c2c3939b4aad203cacdd613a62ce1fd032c < eb08fca56f1f39e4038cb9bac9864464b13b00aaeb08fca56f1f39e4038cb9bac9864464b13b00aa
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.244-15.10.244-1
linuxlinux_kernel>= 0 < 6.1.147-16.1.147-1
linuxlinux_kernel>= 0 < 6.12.37-16.12.37-1
linuxlinux_kernel>= 0 < 6.12.37-16.12.37-1
msrcazl3_kernel_6.6.96.2-1_on_azure_linux_3.0

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.