From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 34CC13D7A0F for ; Mon, 10 Aug 2026 12:10:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786363815; cv=none; b=G4GzqrHHtGNoxCqekRO4ksDymXTIphcE1LgDevs0bzuj6Al6pJPbgtydgtiQlRIYNxgQHd1t6GxvxBGwpynHH0ZW66WDy4T+n5pSt63bvp3FtCkAbd+VhlQtQWPW84MHGollo1nS5koVReCkx56KJNL/9sEf0uyx0KDk7U5rxsw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786363815; c=relaxed/simple; bh=Nm+k1Jkswdm76GHE2BlMTOIeuKDATpn27gn8ZEoqkuk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=bsoLnPZqLK2//hq0YugJ3hBP8b3z74OoKy3DomA5jUYAsGe4Z5zmyUrRMB5z+B5RaDCFvXC1WBpO7gjKxLbyqU9cK5nlWDxswn9v+m8NAtqBL49WBnVmPyuAlHm3RI4n9tic++aZuAFtnc9EXQuqOACDfo8vSrpHY6tNCwpZ+is= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=DmdJoxbR; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="DmdJoxbR" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A618A1F00A3E; Mon, 10 Aug 2026 12:10:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786363814; bh=e7c+I68NwmTxXtR+L5qzKtqdQQfJMrOi1jE8eQFm3NQ=; h=From:To:Cc:Subject:Date:Reply-To; b=DmdJoxbR/dD3F8I51TJa6i06D3ktPAgHZ0dY/H8TN+nV2R6asBC+3vH89TtOrCiq9 9sofNIo/0jEN/0Khp1ECq8zmKw/9eM0pdqUgxS2usbsncs12Xuf89tsTd7u6vRWBoo 985j4tsDT5A+n9JMGUV5yPA+S0q9nt6X0Yh5uFDo= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-68278: drm/dp/mst: fix buffer overflows in sideband chunk accumulation Date: Mon, 10 Aug 2026 13:59:55 +0200 Message-ID: <2026081025-CVE-2026-68278-ddb6@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3601; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=0j1poA/VkkICikYI1ED4Uq4ntrcYpH8Cq6WUSG7Y2Oo=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmVe5Z293V7/Ww9n/9lyj0j0/3LPzBE1yvI5jpwrhPNk X33U6+pI5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACbSuZxhwSL+5AXHtjQwx/to PVVwMDvlIXk2k2HBuZ7w2tr9NasMBZfl9RxdXOT/lq8SAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix buffer overflows in sideband chunk accumulation drm_dp_sideband_append_payload() has three related bugs when processing device-provided sideband reply data: 1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken directly from the DP sideband header. If a device sends msg_len=0, curchunk_len is set to zero. The condition (curchunk_idx >= curchunk_len) is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow). drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy() writes 255 bytes into msg[], both far out of bounds. 2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks until curchunk_idx reaches curchunk_len, writing up to 15 bytes past the end of chunk[] into msg[]. 3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to msg[]. No check ensures curlen + (curchunk_len-1) stays within msg[256], so the memcpy can spill into adjacent struct fields. All three are reachable from any DP MST device that can forge sideband reply messages on a physical connection. The Linux kernel CVE team has assigned CVE-2026-68278 to this issue. Affected and fixed versions =========================== Issue introduced in 3.17 with commit ad7f8a1f9ced7f049f9b66d588723f243a7034cd and fixed in 6.6.148 with commit 53937a2787d29c7a460e984dc4f20ff6ac91dc65 Issue introduced in 3.17 with commit ad7f8a1f9ced7f049f9b66d588723f243a7034cd and fixed in 6.12.101 with commit ef0dbcc200c3389f1f781ab181932a97e54b51af Issue introduced in 3.17 with commit ad7f8a1f9ced7f049f9b66d588723f243a7034cd and fixed in 6.18.42 with commit 1e5827839ad0ceb0079d1560c321fa3656b54f21 Issue introduced in 3.17 with commit ad7f8a1f9ced7f049f9b66d588723f243a7034cd and fixed in 7.1.6 with commit a6366b551079c79bf7bdbadd74c97358bcfe2d58 Issue introduced in 3.17 with commit ad7f8a1f9ced7f049f9b66d588723f243a7034cd and fixed in 7.2-rc1 with commit 55bd5e685bda455b9b50c835f8c8442d52a344a3 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-68278 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/gpu/drm/display/drm_dp_mst_topology.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/53937a2787d29c7a460e984dc4f20ff6ac91dc65 https://git.kernel.org/stable/c/ef0dbcc200c3389f1f781ab181932a97e54b51af https://git.kernel.org/stable/c/1e5827839ad0ceb0079d1560c321fa3656b54f21 https://git.kernel.org/stable/c/a6366b551079c79bf7bdbadd74c97358bcfe2d58 https://git.kernel.org/stable/c/55bd5e685bda455b9b50c835f8c8442d52a344a3