CVE-2026-53135
drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs [Why & How] dp_sdp_message_debugfs_write() dereferences connector->base.state->crtc without checking for NULL. A connector can be connected but not bound to any CRTC (e.g. after hot-plug before the next atomic commit), causing a kernel crash when writing to the sdp_message debugfs node. The function also ignores the user-provided size argument and always passes 36 bytes to copy_from_user(), reading past the user buffer when size < 36. Fix both issues by: - Returning -ENODEV when connector->base.state or state->crtc is NULL - Clamping write_size to min(size, sizeof(data)) (cherry picked from commit 6ab4c36a522842ff70474a1c0af2e40e50fc8300)
INFO
Published Date :
June 25, 2026, 9:16 a.m.
Last Modified :
July 7, 2026, 4:57 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Check for NULL connector state and CRTC.
- Return -ENODEV if state or CRTC is NULL.
- Clamp write size to the buffer size.
- Apply the vendor-supplied patch.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53135.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53135 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53135
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53135 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53135 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 07, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-476 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.176 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.143 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.210 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.36 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.94 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.13 *cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.2 up to (excluding) 5.10.259 Added Reference Type kernel.org: https://git.kernel.org/stable/c/7ae95c0275c330b5dbae806f8e431720edad776f Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/7fc4fab4acc307ad2903312c195872b2953d32c3 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/a2de1d71891a038a9346b2c1a72b88c8350f2479 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/adf67034b1f61f7119295208085bfd43f85f56af Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/b781f90a9528555c709e59789550893581ef0be4 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/bb6f705b73b5f191f14ad004e2c8c4b615806187 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/c90954cdea4d6998ec345de0d840d030c145b89e Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ee9cfcf77a8e8af637396dc00966df5f701e661c Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 25, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'c7ba3653e9773256b2b08508a2ed2ca28ea7566b', 'lessThan': 'ee9cfcf77a8e8af637396dc00966df5f701e661c', 'versionType': 'git'}, {'status': 'affected', 'version': 'c7ba3653e9773256b2b08508a2ed2ca28ea7566b', 'lessThan': 'b781f90a9528555c709e59789550893581ef0be4', 'versionType': 'git'}, {'status': 'affected', 'version': 'c7ba3653e9773256b2b08508a2ed2ca28ea7566b', 'lessThan': 'a2de1d71891a038a9346b2c1a72b88c8350f2479', 'versionType': 'git'}, {'status': 'affected', 'version': 'c7ba3653e9773256b2b08508a2ed2ca28ea7566b', 'lessThan': '7fc4fab4acc307ad2903312c195872b2953d32c3', 'versionType': 'git'}, {'status': 'affected', 'version': 'c7ba3653e9773256b2b08508a2ed2ca28ea7566b', 'lessThan': '7ae95c0275c330b5dbae806f8e431720edad776f', 'versionType': 'git'}, {'status': 'affected', 'version': 'c7ba3653e9773256b2b08508a2ed2ca28ea7566b', 'lessThan': 'bb6f705b73b5f191f14ad004e2c8c4b615806187', 'versionType': 'git'}, {'status': 'affected', 'version': 'c7ba3653e9773256b2b08508a2ed2ca28ea7566b', 'lessThan': 'c90954cdea4d6998ec345de0d840d030c145b89e', 'versionType': 'git'}, {'status': 'affected', 'version': 'c7ba3653e9773256b2b08508a2ed2ca28ea7566b', 'lessThan': 'adf67034b1f61f7119295208085bfd43f85f56af', 'versionType': 'git'}], 'programFiles': ['drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.2'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.2', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.259', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.210', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.94', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.36', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.13', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs [Why & How] dp_sdp_message_debugfs_write() dereferences connector->base.state->crtc without checking for NULL. A connector can be connected but not bound to any CRTC (e.g. after hot-plug before the next atomic commit), causing a kernel crash when writing to the sdp_message debugfs node. The function also ignores the user-provided size argument and always passes 36 bytes to copy_from_user(), reading past the user buffer when size < 36. Fix both issues by: - Returning -ENODEV when connector->base.state or state->crtc is NULL - Clamping write_size to min(size, sizeof(data)) (cherry picked from commit 6ab4c36a522842ff70474a1c0af2e40e50fc8300) Added Reference https://git.kernel.org/stable/c/7ae95c0275c330b5dbae806f8e431720edad776f Added Reference https://git.kernel.org/stable/c/7fc4fab4acc307ad2903312c195872b2953d32c3 Added Reference https://git.kernel.org/stable/c/a2de1d71891a038a9346b2c1a72b88c8350f2479 Added Reference https://git.kernel.org/stable/c/adf67034b1f61f7119295208085bfd43f85f56af Added Reference https://git.kernel.org/stable/c/b781f90a9528555c709e59789550893581ef0be4 Added Reference https://git.kernel.org/stable/c/bb6f705b73b5f191f14ad004e2c8c4b615806187 Added Reference https://git.kernel.org/stable/c/c90954cdea4d6998ec345de0d840d030c145b89e Added Reference https://git.kernel.org/stable/c/ee9cfcf77a8e8af637396dc00966df5f701e661c