CVE-2026-68278

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/dp/mst: fix buffer overflows in sideband chunk accumulation

drm_dp_sideband_append_payload() has three related bugs when processing

device-provided sideband reply data:

1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken

directly from the DP sideband header. If a device sends msg_len=0,

curchunk_len is set to zero. The condition (curchunk_idx >= curchunk_len)

is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow).

drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy()

writes 255 bytes into msg[], both far out of bounds.

2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is

only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks

until curchunk_idx reaches curchunk_len, writing up to 15 bytes past

the end of chunk[] into msg[].

3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to

msg[]. N

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References