CVE-2026-64219
Received Received - Intake

Buffer Overflow in AMD Display Driver

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async [Why&How] dc_process_dmub_aux_transfer_async() copies payload->length bytes into a 16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(), which is a no-op in release builds. If a caller ever passes length > 16 this results in a stack buffer overflow via memcpy. Additionally, link_index is used to dereference dc->links[] without bounds checking against dc->link_count, risking an out-of-bounds access. Replace the ASSERT with a hard runtime check that returns false when payload->length exceeds the destination buffer size, and add a bounds check for link_index before it is used. (cherry picked from commit ba4caa9fecdf7a38f98c878ad05a8a64148b6881)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-64219
EUVD
EUVD-2026-48627

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack buffer overflow in the Linux kernel's AMD display driver. It occurs in the function dc_process_dmub_aux_transfer_async() where a payload length is copied into a fixed 16-byte stack buffer without proper bounds checking. If the payload length exceeds 16 bytes, it overwrites adjacent stack memory. Additionally, the function accesses an array using link_index without verifying it is within valid bounds, risking out-of-bounds access.

Detection Guidance

This vulnerability is specific to the Linux kernel's AMD display driver (drm/amd/display). Detection requires checking kernel versions and examining the affected driver code. Use commands like 'uname -a' to check kernel version and 'modinfo amdgpu' or 'lsmod | grep amdgpu' to verify if the AMD display driver is loaded.

Impact Analysis

This vulnerability could allow an attacker with local access to execute arbitrary code, escalate privileges, or cause a system crash by triggering the buffer overflow or out-of-bounds access. It may lead to denial-of-service conditions or compromise the integrity and confidentiality of the system.

Compliance Impact

This vulnerability involves a stack buffer overflow and out-of-bounds memory access in the Linux kernel's display driver. While it does not directly impact compliance with standards like GDPR or HIPAA, such low-level memory corruption issues could potentially lead to unauthorized data access or system compromise if exploited. This might indirectly affect compliance by enabling data breaches or system integrity violations.

Mitigation Strategies

Apply the latest kernel updates from your Linux distribution to ensure the patched version is installed. If immediate updates are unavailable, consider disabling the AMD display driver if not required, or restrict access to affected systems until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64219. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart