EUVD-2026-55356

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: bound EDID block reads to the response buffer virtiogetedidblock validates the read offset only against the device-supplied resp-size field, never against the fixed-size resp-edid array. The EDID block index is driven...

CVE-2026-68255 drm/virtio: bound EDID block reads to the response buffer

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: bound EDID block reads to the response buffer virtiogetedidblock validates the read offset only against the device-supplied resp-size field, never against the fixed-size resp-edid array. The EDID block index is driven...

CVE-2026-68255

Summary: CVE-2026-68255 affects the Linux kernel DRM/virtio EDID handling. The function virtio_get_edid_block() validates reads only against the device-supplied resp->size, not against the fixed-size resp->edid array. An attacker-controlled virtio-gpu backend can advertise a large size with...

CVE-2026-68254 drm/i915/vrr: require valid min/max vfreq for VRR

In the Linux kernel, the following vulnerability has been resolved: drm/i915/vrr: require valid min/max vfreq for VRR Ensure the EDID provided min/max vfreq are valid. Most scenarios are already covered by coincidence through the checks in intelvrriscapable and intelvrrisinrange, but be more...

CVE-2026-68254

The Linux kernel component drm/i915/vrr was updated to enforce that EDID-provided min_vfreq and max_vfreq are valid for VRR. The root cause was inadequate validation of VRR frequencies, with a potential division-by-zero in intel_vrr_compute_vmax if min_vfreq was zero. The fix explicitly validates...

EUVD-2026-55355

In the Linux kernel, the following vulnerability has been resolved: drm/i915/vrr: require valid min/max vfreq for VRR Ensure the EDID provided min/max vfreq are valid. Most scenarios are already covered by coincidence through the checks in intelvrriscapable and intelvrrisinrange, but be more...

PT-2026-69655

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the virtio get edid block function. The function validates the read offset against the resp-size field provided by the device but fails to validate it...

Linux Distros Unpatched Vulnerability : CVE-2026-68255

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/virtio: bound EDID block reads to the response buffer virtiogetedidblock validates the read offset only against the device-supplied resp-size field, never...

SUSE CVE-2026-64546

In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drmparsetiledblock drmparsetiledblock casts the DisplayID block to a struct displayidtiledblock and reads the full fixed layout up to tile-topologyid7 without checking block-numbytes. The DisplayID...

Linux Distros Unpatched Vulnerability : CVE-2026-64546

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/edid: fix OOB read in drmparsetiledblock drmparsetiledblock casts the DisplayID block to a struct displayidtiledblock and reads the full fixed layout up to...

CVE-2026-64546

In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drmparsetiledblock drmparsetiledblock casts the DisplayID block to a struct displayidtiledblock and reads the full fixed layout up to tile-topologyid7 without checking block-numbytes. The DisplayID...

AZL-94067 CVE-2026-64546 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drmparsetiledblock drmparsetiledblock casts the DisplayID block to a struct displayidtiledblock and reads the full fixed layout up to tile-topologyid7 without checking block-numbytes. The DisplayID...

CVE-2026-64546

In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drmparsetiledblock drmparsetiledblock casts the DisplayID block to a struct displayidtiledblock and reads the full fixed layout up to tile-topologyid7 without checking block-numbytes. The DisplayID...

UBUNTU-CVE-2026-64546

In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drmparsetiledblock drmparsetiledblock casts the DisplayID block to a struct displayidtiledblock and reads the full fixed layout up to tile-topologyid7 without checking block-numbytes. The DisplayID...

CVE-2026-64546

In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drmparsetiledblock drmparsetiledblock casts the DisplayID block to a struct displayidtiledblock and reads the full fixed layout up to tile-topologyid7 without checking block-numbytes. The DisplayID...

PT-2026-65221

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A heap out-of-bounds read exists in the drm parse tiled block function. The function casts a DisplayID block to a struct displayid tiled block and reads the layout up to tile-topology id...

CVE-2026-64546: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drmparsetiledblock drmparsetiledblock casts the DisplayID block to a struct displayidtiledblock and reads the full fixed layout up to tile-topologyid7 without checking block-numbytes. The DisplayID...

SUSE CVE-2026-53279

In the Linux kernel, the following vulnerability has been resolved: drm/gma500/oaktraillvds: fix hang on init failure The LVDS init code looks up an I2C adapter using i2cgetadapter and tries to read the EDID before falling back to allocating and registering its own adapter. The error handling doe...

The vulnerability of the drm_edid_get_panel_id() function in the drivers/gpu/drm/drm_edid.c module of the Direct Rendering Infrastructure (DRI) driver for the Linux kernel allows a malicious actor to access protected information or cause service failure.

The vulnerability of the drmedidgetpanelid function in the drivers/gpu/drm/drmedid.c module of the Direct Rendering Infrastructure DRI driver for the Linux kernel exposes confidential information. Exploiting this vulnerability could allow an attacker to access protected information or cause servi...

CVE-2026-53279

In the Linux kernel, the following vulnerability has been resolved: drm/gma500/oaktraillvds: fix hang on init failure The LVDS init code looks up an I2C adapter using i2cgetadapter and tries to read the EDID before falling back to allocating and registering its own adapter. The error handling doe...