CVE-2026-68278
drm/dp/mst: fix buffer overflows in sideband chunk accumulation
Description
In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix buffer overflows in sideband chunk accumulation drm_dp_sideband_append_payload() has three related bugs when processing device-provided sideband reply data: 1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken directly from the DP sideband header. If a device sends msg_len=0, curchunk_len is set to zero. The condition (curchunk_idx >= curchunk_len) is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow). drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy() writes 255 bytes into msg[], both far out of bounds. 2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks until curchunk_idx reaches curchunk_len, writing up to 15 bytes past the end of chunk[] into msg[]. 3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to msg[]. No check ensures curlen + (curchunk_len-1) stays within msg[256], so the memcpy can spill into adjacent struct fields. All three are reachable from any DP MST device that can forge sideband reply messages on a physical connection.
INFO
Published Date :
Aug. 10, 2026, 1:20 p.m.
Last Modified :
Aug. 17, 2026, 5:18 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Update the Linux kernel to the latest version.
- Apply relevant patches for drm/dp/mst.
- Verify secure handling of sideband data.
- Test for proper buffer boundary checks.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-68278.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-68278 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-68278
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-68278 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-68278 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': '53937a2787d29c7a460e984dc4f20ff6ac91dc65', 'versionType': 'git'}, {'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': 'ef0dbcc200c3389f1f781ab181932a97e54b51af', 'versionType': 'git'}, {'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': '1e5827839ad0ceb0079d1560c321fa3656b54f21', 'versionType': 'git'}, {'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': 'a6366b551079c79bf7bdbadd74c97358bcfe2d58', 'versionType': 'git'}, {'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': '55bd5e685bda455b9b50c835f8c8442d52a344a3', 'versionType': 'git'}], 'programFiles': ['drivers/gpu/drm/display/drm_dp_mst_topology.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.17'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.17', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/gpu/drm/display/drm_dp_mst_topology.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': '53937a2787d29c7a460e984dc4f20ff6ac91dc65', 'versionType': 'git'}, {'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': 'ef0dbcc200c3389f1f781ab181932a97e54b51af', 'versionType': 'git'}, {'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': '1e5827839ad0ceb0079d1560c321fa3656b54f21', 'versionType': 'git'}, {'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': 'a6366b551079c79bf7bdbadd74c97358bcfe2d58', 'versionType': 'git'}, {'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': '55bd5e685bda455b9b50c835f8c8442d52a344a3', 'versionType': 'git'}], 'programFiles': ['drivers/gpu/drm/display/drm_dp_mst_topology.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.17'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.17', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/gpu/drm/display/drm_dp_mst_topology.c'], 'defaultStatus': 'affected'}] -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 10, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': '53937a2787d29c7a460e984dc4f20ff6ac91dc65', 'versionType': 'git'}, {'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': 'ef0dbcc200c3389f1f781ab181932a97e54b51af', 'versionType': 'git'}, {'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': '1e5827839ad0ceb0079d1560c321fa3656b54f21', 'versionType': 'git'}, {'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': 'a6366b551079c79bf7bdbadd74c97358bcfe2d58', 'versionType': 'git'}, {'status': 'affected', 'version': 'ad7f8a1f9ced7f049f9b66d588723f243a7034cd', 'lessThan': '55bd5e685bda455b9b50c835f8c8442d52a344a3', 'versionType': 'git'}], 'programFiles': ['drivers/gpu/drm/display/drm_dp_mst_topology.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.17'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.17', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/gpu/drm/display/drm_dp_mst_topology.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix buffer overflows in sideband chunk accumulation drm_dp_sideband_append_payload() has three related bugs when processing device-provided sideband reply data: 1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken directly from the DP sideband header. If a device sends msg_len=0, curchunk_len is set to zero. The condition (curchunk_idx >= curchunk_len) is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow). drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy() writes 255 bytes into msg[], both far out of bounds. 2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks until curchunk_idx reaches curchunk_len, writing up to 15 bytes past the end of chunk[] into msg[]. 3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to msg[]. No check ensures curlen + (curchunk_len-1) stays within msg[256], so the memcpy can spill into adjacent struct fields. All three are reachable from any DP MST device that can forge sideband reply messages on a physical connection. Added Reference https://git.kernel.org/stable/c/1e5827839ad0ceb0079d1560c321fa3656b54f21 Added Reference https://git.kernel.org/stable/c/53937a2787d29c7a460e984dc4f20ff6ac91dc65 Added Reference https://git.kernel.org/stable/c/55bd5e685bda455b9b50c835f8c8442d52a344a3 Added Reference https://git.kernel.org/stable/c/a6366b551079c79bf7bdbadd74c97358bcfe2d58 Added Reference https://git.kernel.org/stable/c/ef0dbcc200c3389f1f781ab181932a97e54b51af