CVE-2026-97621drm/rockchip: analogix_dp: fix unchecked bound endpoint name length
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: analogix_dp: fix unchecked bound endpoint name length rockchip_dp_drm_encoder_enable() uses sprintf() to format a device tree path into a 32-byte stack buffer. Device tree paths are not limited to this size, so a sufficiently long path can overflow the buffer. Use snprintf() with the destination size to truncate the generated name and keep the writes within bounds.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 25, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 729f8eefdcadaff98606931e691910f17d8d59d6 builds before 49f5268f43a791dd0d9ff554cce25a3685c7250b; 729f8eefdcadaff98606931e691910f17d8d59d6 builds before 2fcd112caa4ebc64fdcb509f0b26d8daa3fac950; from 729f8eefdcadaff98606931e691910f17d8d59d6 before bc69439d983cc491cc86e01fafc1deb94e1bb85e | CNA record |
References
- https://git.kernel.org/stable/c/49f5268f43a791dd0d9ff554cce25a3685c7250b
- https://git.kernel.org/stable/c/2fcd112caa4ebc64fdcb509f0b26d8daa3fac950
- https://git.kernel.org/stable/c/bc69439d983cc491cc86e01fafc1deb94e1bb85e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.