CVE-2026-97621
Received Received - Intake

Buffer Overflow in Rockchip DRM Analogix DP Driver

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: analogix_dp: fix unchecked bound endpoint name length rockchip_dp_drm_encoder_enable() uses sprintf() to format a device tree path into a 32-byte stack buffer. Device tree paths are not limited to this size, so a sufficiently long path can overflow the buffer. Use snprintf() with the destination size to truncate the generated name and keep the writes within bounds.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-10-15
AI Q&A
2026-09-25
EPSS Evaluated
2026-10-14
NVD
CVE-2026-97621
EUVD
EUVD-2026-86752

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's Rockchip display driver (drm/rockchip: analogix_dp). It involves a buffer overflow in the rockchip_dp_drm_encoder_enable() function where a device tree path is written to a fixed 32-byte stack buffer using sprintf(). Since device tree paths can exceed this size, a long path could overflow the buffer, potentially corrupting memory or causing crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's drm/rockchip analogix_dp driver and involves a buffer overflow due to unchecked device tree path length. Detection requires checking the kernel version and examining the driver code for the affected function. No direct network detection commands are applicable.

Impact Analysis

If exploited, this vulnerability could lead to system instability, crashes, or arbitrary code execution on affected Linux systems using the Rockchip display driver. Attackers might trigger the overflow by providing a specially crafted device tree path, compromising the kernel's integrity.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a buffer overflow issue in the Linux kernel's display driver (drm/rockchip) that could lead to system instability or crashes but does not involve data exposure or privacy violations typical of compliance concerns.

Mitigation Strategies

Apply the latest kernel update that includes the fix for this issue. If a patch is not yet available, avoid using the affected Rockchip DP driver or restrict access to systems using it until patched. Monitor vendor advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97621. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart