CVE-2026-64546

Received Received - Intake

Out-of-Bounds Read in Linux Kernel DRM EDID Parser

Publication date: 2026-07-27

Last updated on: 2026-07-30

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drm_parse_tiled_block() drm_parse_tiled_block() casts the DisplayID block to a struct displayid_tiled_block and reads the full fixed layout up to tile->topology_id[7] without checking block->num_bytes. The DisplayID iterator only validates the declared payload length, so a crafted EDID can advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at the end of a DisplayID extension. The read then runs past the end of the exact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read. Reject blocks shorter than the spec's 22-byte tiled payload before reading the fixed struct, as drm_parse_vesa_mso_data() already does. BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update Read of size 2 at addr ffff888010077700 by task exploit/147 dump_stack_lvl (lib/dump_stack.c:94 ...) print_report (mm/kasan/report.c:378 ...) kasan_report (mm/kasan/report.c:595) drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581) bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574) drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426) status_store (drivers/gpu/drm/drm_sysfs.c:219) ... vfs_write (fs/read_write.c:595 fs/read_write.c:688) ksys_write (fs/read_write.c:740)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-07-30

Generated

2026-08-17

AI Q&A

2026-07-28

EPSS Evaluated

2026-08-15

NVD

CVE-2026-64546

EUVD

EUVD-2026-49597

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a heap out-of-bounds read vulnerability in the Linux kernel's DRM (Direct Rendering Manager) subsystem. It occurs in the drm_parse_tiled_block() function when processing DisplayID blocks in EDID data. The function reads beyond the allocated memory because it doesn't validate the block size before accessing a fixed-size structure, allowing a crafted EDID to trigger a read past the buffer's end.

Detection Guidance

This vulnerability is specific to the Linux kernel's DRM/EDID handling and requires kernel-level detection. Monitor kernel logs for KASAN reports indicating slab-out-of-bounds errors in drm_edid_connector_update. Check for crashes or errors in GPU driver modules like bochs. Use commands like dmesg | grep -i kasan or journalctl -k | grep -i drm to inspect kernel logs for suspicious activity.

Impact Analysis

This vulnerability could allow an attacker to read sensitive kernel memory, potentially exposing passwords, encryption keys, or other confidential data. It may also cause system instability or crashes by corrupting memory. Exploitation requires a specially crafted EDID, which could be provided through malicious display devices or manipulated video signals.

Compliance Impact

This vulnerability is a heap out-of-bounds read in the Linux kernel's EDID parsing code, which could potentially allow information disclosure or memory corruption. While not directly tied to GDPR or HIPAA, such vulnerabilities could impact compliance by exposing sensitive data or enabling unauthorized access to systems handling protected information.

Mitigation Strategies

Update your Linux kernel to the latest patched version that includes the fix for CVE-2026-64546. If immediate patching is not possible, disable the affected DRM modules (e.g., bochs) temporarily. Monitor vendor advisories for kernel updates and apply them promptly.

Hi! I’m here to help you understand CVE-2026-64546. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70