CVE-2026-68278
Received Received - Intake

Buffer Overflow in Linux Kernel DRM DP MST Sideband Processing

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix buffer overflows in sideband chunk accumulation drm_dp_sideband_append_payload() has three related bugs when processing device-provided sideband reply data: 1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken directly from the DP sideband header. If a device sends msg_len=0, curchunk_len is set to zero. The condition (curchunk_idx >= curchunk_len) is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow). drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy() writes 255 bytes into msg[], both far out of bounds. 2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks until curchunk_idx reaches curchunk_len, writing up to 15 bytes past the end of chunk[] into msg[]. 3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to msg[]. No check ensures curlen + (curchunk_len-1) stays within msg[256], so the memcpy can spill into adjacent struct fields. All three are reachable from any DP MST device that can forge sideband reply messages on a physical connection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68278
EUVD
EUVD-2026-55379

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves buffer overflows in the DisplayPort Multi-Stream Transport (MST) sideband message handling. It occurs when processing device-provided sideband reply data, leading to three specific issues: zero-length chunk underflow, chunk array overflow, and message array overflow. These flaws allow out-of-bounds memory access and writes, potentially corrupting kernel memory.

Detection Guidance

This vulnerability is specific to Linux kernel's DRM DisplayPort MST (Multi-Stream Transport) handling. Detection requires checking kernel logs for sideband message processing errors or crashes related to drm_dp_sideband_append_payload. Monitor for kernel oops messages or system hangs during DP MST device interactions.

Impact Analysis

This vulnerability can be exploited by any DP MST device connected to a system. An attacker could send maliciously crafted sideband reply messages to trigger memory corruption, leading to crashes, data corruption, or potential privilege escalation. Systems using affected Linux kernel versions with DP MST support are at risk.

Mitigation Strategies

Update the Linux kernel to the latest patched version. Disable DisplayPort MST functionality if not required. Restrict physical access to systems using DP MST devices. Monitor vendor advisories for firmware updates to connected DP MST devices.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68278. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart