CVE-2026-68277drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Three sideband reply parsers read 16-bit fields as: val = (raw->msg[idx] << 8) | (raw->msg[idx+1]); and check bounds only after the fact. When idx == raw->curlen, raw->msg[idx+1] reads one byte past the received message data into the following struct fields (curchunk_len, curchunk_idx, curlen). Affected functions: - drm_dp_sideband_parse_enum_path_resources_ack() full_payload_bw_number and avail_payload_bw_number fields - drm_dp_sideband_parse_allocate_payload_ack() allocated_pbn field - drm_dp_sideband_parse_query_payload_ack() allocated_pbn field Fix by using a single combined check (idx + 2 > curlen) before each 2-byte read. Since the check is strictly tighter than idx > curlen, no separate step is needed. [added fixes tag]
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 23, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ad7f8a1f9ced7f049f9b66d588723f243a7034cd before c1f72a13d54ffd16647d3fa540d961f5deba8790; from ad7f8a1f9ced7f049f9b66d588723f243a7034cd before 192e146c2d57ad033b0d418ec64ee390f8dc074e; from ad7f8a1f9ced7f049f9b66d588723f243a7034cd before 6e3107e6522109a07fc9bb0fc4ec463f1982e113; from ad7f8a1f9ced7f049f9b66d588723f243a7034cd before bdf0508b1e6785d4a8982c637e97e68d60b47d7b; from ad7f8a1f9ced7f049f9b66d588723f243a7034cd before 0bcd7675c69a2462a8531fcd9e4d096e9c7ec5df; from ad7f8a1f9ced7f049f9b66d588723f243a7034cd before d5c70523cafa26ad2c7a37b612849abe2683baa8; from ad7f8a1f9ced7f049f9b66d588723f243a7034cd before 68a624416d1dd481b3e5b7ea0e8a070a9b8a2c73; from ad7f8a1f9ced7f049f9b66d588723f243a7034cd before 6b89ba3dba2f583626fb693e47e951ffb8bf591f | CNA record |
References
- https://git.kernel.org/stable/c/c1f72a13d54ffd16647d3fa540d961f5deba8790
- https://git.kernel.org/stable/c/192e146c2d57ad033b0d418ec64ee390f8dc074e
- https://git.kernel.org/stable/c/6e3107e6522109a07fc9bb0fc4ec463f1982e113
- https://git.kernel.org/stable/c/bdf0508b1e6785d4a8982c637e97e68d60b47d7b
- https://git.kernel.org/stable/c/0bcd7675c69a2462a8531fcd9e4d096e9c7ec5df
- https://git.kernel.org/stable/c/d5c70523cafa26ad2c7a37b612849abe2683baa8
- https://git.kernel.org/stable/c/68a624416d1dd481b3e5b7ea0e8a070a9b8a2c73
- https://git.kernel.org/stable/c/6b89ba3dba2f583626fb693e47e951ffb8bf591f
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.