CVE-2023-54186 - Vulnerability Details

- usb: typec: altmodes/displayport: fix pin_assignment_show

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: altmodes/displayport: fix pin_assignment_show

This patch fixes negative indexing of buf array in pin_assignment_show
when get_current_pin_assignments returns 0 i.e. no compatible pin
assignments are found.

BUG: KASAN: use-after-free in pin_assignment_show+0x26c/0x33c
...
Call trace:
dump_backtrace+0x110/0x204
dump_stack_lvl+0x84/0xbc
print_report+0x358/0x974
kasan_report+0x9c/0xfc
__do_kernel_fault+0xd4/0x2d4
do_bad_area+0x48/0x168
do_tag_check_fault+0x24/0x38
do_mem_abort+0x6c/0x14c
el1_abort+0x44/0x68
el1h_64_sync_handler+0x64/0xa4
el1h_64_sync+0x78/0x7c
pin_assignment_show+0x26c/0x33c
dev_attr_show+0x50/0xc0

Published: 2025-12-30

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`0e3bb7d6894d9b6e67d6382bb03a46a1dc989588`	affected	< 0e61a7432fcd4bca06f05b7f1c7d7cb461880fe2
`0e3bb7d6894d9b6e67d6382bb03a46a1dc989588`	affected	< 4f9c0a7c272626cb6716ffc7800e8c73260cdce6
`0e3bb7d6894d9b6e67d6382bb03a46a1dc989588`	affected	< ff466f77d0a56719979c4234abd412abd98eae8f
`0e3bb7d6894d9b6e67d6382bb03a46a1dc989588`	affected	< fc0e18f95c88435bd8a1ceb540243cd7fbcd9781
`0e3bb7d6894d9b6e67d6382bb03a46a1dc989588`	affected	< 08bd1be1c716fd50a7df48f82dcbc59a103082b5
`0e3bb7d6894d9b6e67d6382bb03a46a1dc989588`	affected	< 54ee23e4ab263a495ace1eed43d3883212ece17f
`0e3bb7d6894d9b6e67d6382bb03a46a1dc989588`	affected	< d8f28269dd4bf9b55c3fb376ae31512730a96fce

Linux

affected

Version	Status	Constraints
`4.19`	affected	—
`0`	unaffected	< 4.19
`4.19.284`	unaffected	≤ 4.19.*
`5.4.244`	unaffected	≤ 5.4.*
`5.10.181`	unaffected	≤ 5.10.*
`5.15.113`	unaffected	≤ 5.15.*
`6.1.30`	unaffected	≤ 6.1.*
`6.3.4`	unaffected	≤ 6.3.*
`6.4`	unaffected	≤ *

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00047.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/08bd1be1c716fd50a7df48f82dcbc59a103082b5
https://git.kernel.org/stable/c/0e61a7432fcd4bca06f05b7f1c7d7cb461880fe2
https://git.kernel.org/stable/c/4f9c0a7c272626cb6716ffc7800e8c73260cdce6
https://git.kernel.org/stable/c/54ee23e4ab263a495ace1eed43d3883212ece17f
https://git.kernel.org/stable/c/d8f28269dd4bf9b55c3fb376ae31512730a96fce
https://git.kernel.org/stable/c/fc0e18f95c88435bd8a1ceb540243cd7fbcd9781
https://git.kernel.org/stable/c/ff466f77d0a56719979c4234abd412abd98eae8f
https://lore.kernel.org/linux-cve-announce/2025123026-CVE-2023-54186-a9c9@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2023-54186
https://www.cve.org/CVERecord?id=CVE-2023-54186

History

Wed, 31 Dec 2025 12:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2025123026-CVE-2023-54186-a9c9@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2023-54186 https://www.cve.org/CVERecord?id=CVE-2023-54186
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Tue, 30 Dec 2025 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: fix pin_assignment_show This patch fixes negative indexing of buf array in pin_assignment_show when get_current_pin_assignments returns 0 i.e. no compatible pin assignments are found. BUG: KASAN: use-after-free in pin_assignment_show+0x26c/0x33c ... Call trace: dump_backtrace+0x110/0x204 dump_stack_lvl+0x84/0xbc print_report+0x358/0x974 kasan_report+0x9c/0xfc __do_kernel_fault+0xd4/0x2d4 do_bad_area+0x48/0x168 do_tag_check_fault+0x24/0x38 do_mem_abort+0x6c/0x14c el1_abort+0x44/0x68 el1h_64_sync_handler+0x64/0xa4 el1h_64_sync+0x78/0x7c pin_assignment_show+0x26c/0x33c dev_attr_show+0x50/0xc0
Title		usb: typec: altmodes/displayport: fix pin_assignment_show
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/08bd1be1c716fd50a7df48f82dcbc59a103082b5 https://git.kernel.org/stable/c/0e61a7432fcd4bca06f05b7f1c7d7cb461880fe2 https://git.kernel.org/stable/c/4f9c0a7c272626cb6716ffc7800e8c73260cdce6 https://git.kernel.org/stable/c/54ee23e4ab263a495ace1eed43d3883212ece17f https://git.kernel.org/stable/c/d8f28269dd4bf9b55c3fb376ae31512730a96fce https://git.kernel.org/stable/c/fc0e18f95c88435bd8a1ceb540243cd7fbcd9781 https://git.kernel.org/stable/c/ff466f77d0a56719979c4234abd412abd98eae8f

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-12-30T12:08:55.882Z

Updated: 2026-05-11T19:57:07.782Z

Reserved: 2025-12-30T12:06:44.497Z

Link: CVE-2023-54186

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2025-12-30T13:16:06.570

Modified: 2026-04-15T00:35:42.020

Link: CVE-2023-54186

Redhat

Severity : Low

Publid Date: 2025-12-30T00:00:00Z

Links: CVE-2023-54186 - Bugzilla

OpenCVE Enrichment

No data.

Weaknesses

No weakness.

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object