CVE-2026-64219

Analyzed Analyzed - Analysis Complete

Buffer Overflow in AMD Display Driver

Publication date: 2026-07-24

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async [Why&How] dc_process_dmub_aux_transfer_async() copies payload->length bytes into a 16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(), which is a no-op in release builds. If a caller ever passes length > 16 this results in a stack buffer overflow via memcpy. Additionally, link_index is used to dereference dc->links[] without bounds checking against dc->link_count, risking an out-of-bounds access. Replace the ASSERT with a hard runtime check that returns false when payload->length exceeds the destination buffer size, and add a bounds check for link_index before it is used. (cherry picked from commit ba4caa9fecdf7a38f98c878ad05a8a64148b6881)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-24

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-24

EPSS Evaluated

2026-08-12

NVD

CVE-2026-64219

EUVD

EUVD-2026-48627

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.13 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.92 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.142 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability is a stack buffer overflow in the Linux kernel's AMD display driver. It occurs in the function dc_process_dmub_aux_transfer_async() where a payload length is copied into a fixed 16-byte stack buffer without proper bounds checking. If the payload length exceeds 16 bytes, it overwrites adjacent stack memory. Additionally, the function accesses an array using link_index without verifying it is within valid bounds, risking out-of-bounds access.

Detection Guidance

This vulnerability is specific to the Linux kernel's AMD display driver (drm/amd/display). Detection requires checking kernel versions and examining the affected driver code. Use commands like 'uname -a' to check kernel version and 'modinfo amdgpu' or 'lsmod | grep amdgpu' to verify if the AMD display driver is loaded.

Impact Analysis

This vulnerability could allow an attacker with local access to execute arbitrary code, escalate privileges, or cause a system crash by triggering the buffer overflow or out-of-bounds access. It may lead to denial-of-service conditions or compromise the integrity and confidentiality of the system.

Compliance Impact

This vulnerability involves a stack buffer overflow and out-of-bounds memory access in the Linux kernel's display driver. While it does not directly impact compliance with standards like GDPR or HIPAA, such low-level memory corruption issues could potentially lead to unauthorized data access or system compromise if exploited. This might indirectly affect compliance by enabling data breaches or system integrity violations.

Mitigation Strategies

Apply the latest kernel updates from your Linux distribution to ensure the patched version is installed. If immediate updates are unavailable, consider disabling the AMD display driver if not required, or restrict access to affected systems until a patch is applied.

Hi! I’m here to help you understand CVE-2026-64219. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70