CVE-2026-68277
drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
Description
In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Three sideband reply parsers read 16-bit fields as: val = (raw->msg[idx] << 8) | (raw->msg[idx+1]); and check bounds only after the fact. When idx == raw->curlen, raw->msg[idx+1] reads one byte past the received message data into the following struct fields (curchunk_len, curchunk_idx, curlen). Affected functions: - drm_dp_sideband_parse_enum_path_resources_ack() full_payload_bw_number and avail_payload_bw_number fields - drm_dp_sideband_parse_allocate_payload_ack() allocated_pbn field - drm_dp_sideband_parse_query_payload_ack() allocated_pbn field Fix by using a single combined check (idx + 2 > curlen) before each 2-byte read. Since the check is strictly tighter than idx > curlen, no separate step is needed. [added fixes tag]
INFO
Published Date :
Aug. 10, 2026, 1:20 p.m.
Last Modified :
Aug. 17, 2026, 5:18 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Apply the Linux kernel patch.
- Update the Linux kernel.
- Verify the patch is applied.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-68277.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-68277 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-68277
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-68277 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-68277 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': 'bdf0508b1e6785d4a8982c637e97e68d60b47d7b', 'versionType': 'git'}, {'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': '0bcd7675c69a2462a8531fcd9e4d096e9c7ec5df', 'versionType': 'git'}, {'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': 'd5c70523cafa26ad2c7a37b612849abe2683baa8', 'versionType': 'git'}, {'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': '68a624416d1dd481b3e5b7ea0e8a070a9b8a2c73', 'versionType': 'git'}, {'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': '6b89ba3dba2f583626fb693e47e951ffb8bf591f', 'versionType': 'git'}], 'programFiles': ['drivers/gpu/drm/display/drm_dp_mst_topology.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.17'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.17', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/gpu/drm/display/drm_dp_mst_topology.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': 'bdf0508b1e6785d4a8982c637e97e68d60b47d7b', 'versionType': 'git'}, {'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': '0bcd7675c69a2462a8531fcd9e4d096e9c7ec5df', 'versionType': 'git'}, {'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': 'd5c70523cafa26ad2c7a37b612849abe2683baa8', 'versionType': 'git'}, {'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': '68a624416d1dd481b3e5b7ea0e8a070a9b8a2c73', 'versionType': 'git'}, {'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': '6b89ba3dba2f583626fb693e47e951ffb8bf591f', 'versionType': 'git'}], 'programFiles': ['drivers/gpu/drm/display/drm_dp_mst_topology.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.17'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.17', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/gpu/drm/display/drm_dp_mst_topology.c'], 'defaultStatus': 'affected'}] -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 10, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': 'bdf0508b1e6785d4a8982c637e97e68d60b47d7b', 'versionType': 'git'}, {'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': '0bcd7675c69a2462a8531fcd9e4d096e9c7ec5df', 'versionType': 'git'}, {'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': 'd5c70523cafa26ad2c7a37b612849abe2683baa8', 'versionType': 'git'}, {'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': '68a624416d1dd481b3e5b7ea0e8a070a9b8a2c73', 'versionType': 'git'}, {'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': '6b89ba3dba2f583626fb693e47e951ffb8bf591f', 'versionType': 'git'}], 'programFiles': ['drivers/gpu/drm/display/drm_dp_mst_topology.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.17'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.17', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/gpu/drm/display/drm_dp_mst_topology.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Three sideband reply parsers read 16-bit fields as: val = (raw->msg[idx] << 8) | (raw->msg[idx+1]); and check bounds only after the fact. When idx == raw->curlen, raw->msg[idx+1] reads one byte past the received message data into the following struct fields (curchunk_len, curchunk_idx, curlen). Affected functions: - drm_dp_sideband_parse_enum_path_resources_ack() full_payload_bw_number and avail_payload_bw_number fields - drm_dp_sideband_parse_allocate_payload_ack() allocated_pbn field - drm_dp_sideband_parse_query_payload_ack() allocated_pbn field Fix by using a single combined check (idx + 2 > curlen) before each 2-byte read. Since the check is strictly tighter than idx > curlen, no separate step is needed. [added fixes tag] Added Reference https://git.kernel.org/stable/c/0bcd7675c69a2462a8531fcd9e4d096e9c7ec5df Added Reference https://git.kernel.org/stable/c/68a624416d1dd481b3e5b7ea0e8a070a9b8a2c73 Added Reference https://git.kernel.org/stable/c/6b89ba3dba2f583626fb693e47e951ffb8bf591f Added Reference https://git.kernel.org/stable/c/bdf0508b1e6785d4a8982c637e97e68d60b47d7b Added Reference https://git.kernel.org/stable/c/d5c70523cafa26ad2c7a37b612849abe2683baa8