CVE-2026-53135

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference and buffer over-read exist in the SDP debugfs. The function dp sdp message debugfs write() dereferences connector->base.state->crtc without verifying if it is NULL. This can occur when a connector is connected but not bound to any CRTC, leading to a kernel crash when writing to the sdp message debugfs node. Additionally, the function ignores the user-provided size argument and consistently passes 36 bytes to copy from user(), which results in reading past the user buffer if the provided size is less than 36 bytes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.