CVE-2026-68277

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers

Three sideband reply parsers read 16-bit fields as:

val = (raw->msg[idx] << 8) | (raw->msg[idx+1]);

and check bounds only after the fact. When idx == raw->curlen,

raw->msg[idx+1] reads one byte past the received message data into

the following struct fields (curchunk_len, curchunk_idx, curlen).

Affected functions:

- drm_dp_sideband_parse_enum_path_resources_ack()

full_payload_bw_number and avail_payload_bw_number fields

- drm_dp_sideband_parse_allocate_payload_ack()

allocated_pbn field

- drm_dp_sideband_parse_query_payload_ack()

allocated_pbn field

Fix by using a single combined check (idx + 2 > curlen) before each

2-byte read. Since the check is strictly tighter than idx > curlen,

no separate step is needed.

[added fixes tag]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References