SUSE CVE-2026-68277

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Three sideband reply parsers read 16-bit fields as: val = raw-msgidx msgidx+1; and check bounds only after the fact. When idx == raw-curlen, raw-msgidx+1 reads...

SUSE CVE-2026-68429

In the Linux kernel, the following vulnerability has been resolved: drm/dpmst: Handle torn-down topology gracefully in drmdpmsttopologyqueueprobe A hotplug or link-loss event can tear down the MST topology setting mgr-mststate = false and mgr-mstprimary = NULL concurrently with a caller invoking...

CVE-2026-68429

A flaw was found in the Linux kernel's DisplayPort DP Multi-Stream Transport MST module. A race condition can occur during hotplug or link-loss events when the MST topology is being torn down while the drmdpmsttopologyqueueprobe function is called. This can lead to spurious kernel warnings and...

CVE-2026-68429

In the Linux kernel, the following vulnerability has been resolved: drm/dpmst: Handle torn-down topology gracefully in drmdpmsttopologyqueueprobe A hotplug or link-loss event can tear down the MST topology setting mgr-mststate = false and mgr-mstprimary = NULL concurrently with a caller invoking...

DEBIAN-CVE-2026-68429

In the Linux kernel, the following vulnerability has been resolved: drm/dpmst: Handle torn-down topology gracefully in drmdpmsttopologyqueueprobe A hotplug or link-loss event can tear down the MST topology setting mgr-mststate = false and mgr-mstprimary = NULL concurrently with a caller invoking...

CVE-2026-68429

In the Linux kernel, the following vulnerability has been resolved: drm/dpmst: Handle torn-down topology gracefully in drmdpmsttopologyqueueprobe A hotplug or link-loss event can tear down the MST topology setting mgr-mststate = false and mgr-mstprimary = NULL concurrently with a caller invoking...

CVE-2026-68429 drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()

In the Linux kernel, the following vulnerability has been resolved: drm/dpmst: Handle torn-down topology gracefully in drmdpmsttopologyqueueprobe A hotplug or link-loss event can tear down the MST topology setting mgr-mststate = false and mgr-mstprimary = NULL concurrently with a caller invoking...

CVE-2026-68429

In the Linux kernel, the following vulnerability has been resolved: drm/dpmst: Handle torn-down topology gracefully in drmdpmsttopologyqueueprobe A hotplug or link-loss event can tear down the MST topology setting mgr-mststate = false and mgr-mstprimary = NULL concurrently with a caller invoking...

Linux Distros Unpatched Vulnerability : CVE-2026-68429

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/dpmst: Handle torn-down topology gracefully in drmdpmsttopologyqueueprobe A hotplug or link- loss event can tear down the MST topology setting mgr-mststate ...

PT-2026-70943

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the drm/dp mst component. A hotplug or link-loss event can tear down the MST Multi-Stream Transport topology by setting mgr-mst state to false and mgr-mst...

CVE-2026-68241

A flaw was found in the Linux kernel's DisplayPort Multi-Stream Transport MST subsystem. An unbounded loop in the inteldpcheckmststatus function, responsible for servicing interrupts from a sink device, can lead to a system becoming unresponsive. A malicious or faulty DisplayPort MST sink device...

CVE-2026-68279

A flaw was found in the Linux kernel's DisplayPort DP Multi-Stream Transport MST subsystem. A malicious or misbehaving MST hub could send a specially crafted sideband message that causes an out-of-bounds read in the drmdpsidebandparseremotedpcdread and drmdpsidebandparseremotei2creadack functions...

CVE-2026-68277

A flaw was found in the Linux kernel's drm/dp/mst Direct Rendering Manager/DisplayPort/Multi-Stream Transport sideband reply parsers. This out-of-bounds read vulnerability occurs when processing 2-byte fields in sideband replies, where the system attempts to read beyond the allocated buffer. A...

CVE-2026-68278

A flaw was found in the Linux kernel's DisplayPort DP Multi-Stream Transport MST subsystem. This vulnerability involves multiple buffer overflows within the drmdpsidebandappendpayload function when handling data from connected devices. A physically connected, malicious DP MST device can exploit...

CVE-2026-68235

A flaw was found in the Linux kernel's AMD display drm/amd/display driver. This vulnerability occurs when handling DisplayPort Multi-Stream Transport MST for DCE8-class ASICs, where the system may incorrectly assign an analog encoder that lacks necessary DisplayPort functions. This misassignment...

drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers

...

drm/dp/mst: fix buffer overflows in sideband chunk accumulation

...

CVE-2026-68279

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers drmdpsidebandparseremotedpcdread reads numbytes from the raw message and then unconditionally does: memcpybytes, &raw-msgidx, numbytes; without checking that idx...

CVE-2026-68278

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix buffer overflows in sideband chunk accumulation drmdpsidebandappendpayload has three related bugs when processing device-provided sideband reply data: 1. Zero-length curchunklen underflow: msglen is a 6-bit field...

CVE-2026-68277

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Three sideband reply parsers read 16-bit fields as: val = raw-msgidx msgidx+1; and check bounds only after the fact. When idx == raw-curlen, raw-msgidx+1 reads...