LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54186: usb: typec: altmodes/displayport: fix pin_assignment_show

In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: fix pin_assignment_show This patch fixes negative indexing of buf array in pin_assignment_show when get_current_pin_assignments returns 0 i.e. no compatible pin assignments are found. BUG: KASAN: use-after-free in pin_assignment_show+0x26c/0x33c ... Call trace: dump_backtrace+0x110/0x204 dump_stack_lvl+0x84/0xbc print_report+0x358/0x974 kasan_report+0x9c/0xfc __do_kernel_fault+0xd4/0x2d4 do_bad_area+0x48/0x168 do_tag_check_fault+0x24/0x38 do_mem_abort+0x6c/0x14c el1_abort+0x44/0x68 el1h_64_sync_handler+0x64/0xa4 el1h_64_sync+0x78/0x7c pin_assignment_show+0x26c/0x33c dev_attr_show+0x50/0xc0

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel flaw is in USB Type-C DisplayPort alternate-mode handling. When no compatible pin assignments exist, the kernel can index a buffer incorrectly and hit a memory-safety fault. The public record does not provide CVSS, confirmed business impact, or active exploitation evidence.

Executive priority

Treat this as routine-to-prioritized kernel maintenance, not an emergency, unless your environment has high-risk physical USB-C exposure. The absence of CVSS and exploitation evidence limits certainty, so focus on inventory and standard kernel update cadence.

Technical view

The issue is negative indexing in pin_assignment_show after get_current_pin_assignments returns 0. The record shows a KASAN use-after-free report and kernel call trace. It is resolved by Linux stable commits for affected kernel lines, but the bundle does not describe privilege requirements or exploitability.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions with USB Type-C DisplayPort alternate-mode code in use. Client devices, workstations, and servers with accessible USB-C/DP-alt-mode hardware are the most plausible concern. Remote network exposure is not supported by the sources.

Exploitation context

CISA KEV status is false, and the supplied sources do not state active exploitation or public exploit availability. The record documents a kernel memory-safety bug and fix, but not a weaponized attack path.

Researcher notes

The useful technical signal is the zero-return path from get_current_pin_assignments leading to negative buffer indexing in pin_assignment_show. The public bundle lacks CWE, CVSS, detailed reachability, and attacker prerequisite data, so impact assessment should stay conservative.

Mitigation direction

  • Identify Linux systems running the affected kernel versions listed in the CVE record.
  • Apply vendor or distribution kernel updates containing the referenced stable fixes.
  • For unmanaged kernels, review the linked upstream stable commits before backporting.
  • Prioritize devices where USB-C DisplayPort alternate mode is available or physically accessible.

Validation and detection

  • Check deployed kernel versions against the CVE affected-version list.
  • Confirm distro advisories or changelogs reference CVE-2023-54186 or the linked commits.
  • Verify updated kernels include the pin_assignment_show fix.
  • Review crash telemetry for matching KASAN or pin_assignment_show traces.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54186 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux0e3bb7d6894d9b6e67d6382bb03a46a1dc989588, 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588, 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588, 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588, 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588, 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588, 0e3bb7d6894d9b6e67d6382bb03a46a1dc989588unaffected
LinuxLinux4.19, 0, 4.19.284, 5.4.244, 5.10.181, 5.15.113, 6.1.30, 6.3.4, 6.4affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.