CVE-2026-64546

CVE CVE-2026-64546EUVD EUVD-2026-49597Published 2026-07-27T20:10:37.000ZLast changed 2026-08-05T12:42:52.000ZCVSS 7.1

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drm_parse_tiled_block() drm_parse_tiled_block() casts the DisplayID block to a struct displayid_tiled_block and reads the full fixed layout up to tile->topology_id[7] without checking block->num_bytes. The DisplayID iterator only validates the declared payload length, so a crafted EDID can advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at the end of a DisplayID extension. The read then runs past the end of the exact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read. Reject blocks shorter than the spec's 22-byte tiled payload before reading the fixed struct, as drm_parse_vesa_mso_data() already does. BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update Read of size 2 at addr ffff888010077700 by task exploit/147 dump_stack_lvl (lib/dump_stack.c:94 ...) print_report (mm/kasan/report.c:378 ...) kasan_report (mm/kasan/report.c:595) drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581) bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574) drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426) status_store (drivers/gpu/drm/drm_sysfs.c:219) ... vfs_write (fs/read_write.c:595 fs/read_write.c:688) ksys_write (fs/read_write.c:740)

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux patch: 7.2-rc1; 3.19; 40d9b043a89e2301e1f97ade055a73ecc28e9afe <4137e1ecec9c8cb6c4fcee28ffabbbc7409eb7fb; patch: 6.6.145; 40d9b043a89e2301e1f97ade055a73ecc28e9afe <9acd5c1ddc17ca4c5ffa0c373e3fdf480506e061; 40d9b043a89e2301e1f97ade055a73ecc28e9afe <157727131ce8a52d8d9bc676c372ef82db6436c4; 40d9b043a89e2301e1f97ade055a73ecc28e9afe <bfa05d89dc3ca3fb1a9099ef5185549a5ec8490d; patch: 6.1.178; patch: 0; patch: 6.18.40; patch: 5.10.261; patch: 5.15.212; 40d9b043a89e2301e1f97ade055a73ecc28e9afe <9cc0f8e63e8c34cf43def35cbd305ba711181a1f; 40d9b043a89e2301e1f97ade055a73ecc28e9afe <c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0; 40d9b043a89e2301e1f97ade055a73ecc28e9afe <faaa1e1155833e7d4ce7e3cfaf64c0d636b190db; patch: 7.1.5; patch: 6.12.97; 40d9b043a89e2301e1f97ade055a73ecc28e9afe <4f5484d25f85ad6c989bad5f6a43450cecfcfd28

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.