CVE-2026-68277

A flaw was found in the Linux kernel's drm/dp/mst Direct Rendering Manager/DisplayPort/Multi-Stream Transport sideband reply parsers. This out-of-bounds read vulnerability occurs when processing 2-byte fields in sideband replies, where the system attempts to read beyond the allocated buffer. A...

UBUNTU-CVE-2026-68277

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Three sideband reply parsers read 16-bit fields as: val = raw-msgidx msgidx+1; and check bounds only after the fact. When idx == raw-curlen, raw-msgidx+1 reads...

CVE-2026-68277

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Three sideband reply parsers read 16-bit fields as: val = raw-msgidx msgidx+1; and check bounds only after the fact. When idx == raw-curlen, raw-msgidx+1 reads...

CVE-2026-68278

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix buffer overflows in sideband chunk accumulation drmdpsidebandappendpayload has three related bugs when processing device-provided sideband reply data: 1. Zero-length curchunklen underflow: msglen is a 6-bit field...

UBUNTU-CVE-2026-68278

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix buffer overflows in sideband chunk accumulation drmdpsidebandappendpayload has three related bugs when processing device-provided sideband reply data: 1. Zero-length curchunklen underflow: msglen is a 6-bit field...

CVE-2026-68278 drm/dp/mst: fix buffer overflows in sideband chunk accumulation

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix buffer overflows in sideband chunk accumulation drmdpsidebandappendpayload has three related bugs when processing device-provided sideband reply data: 1. Zero-length curchunklen underflow: msglen is a 6-bit field...

CVE-2026-68277

The CVE-2026-68277 entry concerns Linux kernel DRM/DP/MST sideband reply parsers where three 16-bit reads check bounds after reading, risking out-of-bounds access (idx == curlen). A fix was applied: pre-check using a single combined condition (idx + 2 > curlen) before each 2-byte read. Affecte...

EUVD-2026-55378

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Three sideband reply parsers read 16-bit fields as: val = raw-msgidx msgidx+1; and check bounds only after the fact. When idx == raw-curlen, raw-msgidx+1 reads...

CVE-2026-68277 drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Three sideband reply parsers read 16-bit fields as: val = raw-msgidx msgidx+1; and check bounds only after the fact. When idx == raw-curlen, raw-msgidx+1 reads...

CVE-2026-68277: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Three sideband reply parsers read 16-bit fields as: val = raw-msgidx msgidx+1; and check bounds only after the fact. When idx == raw-curlen, raw-msgidx+1 reads...

CVE-2026-68279: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers drmdpsidebandparseremotedpcdread reads numbytes from the raw message and then unconditionally does: memcpybytes, &raw-msgidx, numbytes; without checking that idx...