CVE-2026-68278

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The drm dp sideband append payload() function contains three buffer overflow issues when processing sideband reply data from a DisplayPort Multi-Stream Transport (DP MST) device. First, if a device sends a msg len of 0, a u8 underflow occurs, causing drm dp msg data crc4() to read and memcpy() to write 255 bytes out of bounds. Second, because curchunk len can reach 63 while the chunk[] buffer is only 48 bytes, payload assembly can write up to 15 bytes past the end of chunk[] into msg[]. Third, the lack of boundary checks for curlen and curchunk len allows memcpy() to overflow the msg[256] buffer into adjacent structure fields. These issues can be triggered by a malicious DP MST device capable of forging sideband reply messages over a physical connection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.