CVE-2026-80749drm/connector/hdmi: Fix out of bounds memory read
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/connector/hdmi: Fix out of bounds memory read A helper function was copying a given audio infoframe into the connector's copy but using the size of the destination (a generic target, sized to accept many different data blocks) not the source (a very specific type of data block). Thus, it was copying 60 bytes of data from a 28 byte allocation. Fix that by using the source size instead, together with a build bug on the source size actually being smaller than the destination. I hit this running KUnit tests under KASAN (while debugging something else entirely). In the real world, it seems unlikely to cause an actual problem. It is a read not a write so it can't corrupt any memory. However, it could potentially fall off the end of a page and cause an accvio bug.
- CVSS
- 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 4, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from f378b77227bc4732922c57f92be89438bb1018a1 before d9f7454c185c0c7f0973e11d62ad6c06862c324c; from f378b77227bc4732922c57f92be89438bb1018a1 before e5b527804a1ea4f70e139179d3062cf5de8c06ab; from f378b77227bc4732922c57f92be89438bb1018a1 before f72bb95732bc5ca87b50c52c8f087ba501950809; from f378b77227bc4732922c57f92be89438bb1018a1 before 9ecf8ba763d0ffe0673538eb4bf7806f20455d19 | CNA record |
References
- https://git.kernel.org/stable/c/d9f7454c185c0c7f0973e11d62ad6c06862c324c
- https://git.kernel.org/stable/c/e5b527804a1ea4f70e139179d3062cf5de8c06ab
- https://git.kernel.org/stable/c/f72bb95732bc5ca87b50c52c8f087ba501950809
- https://git.kernel.org/stable/c/9ecf8ba763d0ffe0673538eb4bf7806f20455d19
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.