CVE-2021-47444

What it actually does

Missing bounds check in connector_bad_edid() permits out-of-bounds memory access when an EDID error occurs in the first block before num_blocks-based reallocation, violating the expected size of edid[0x7e] + 1 blocks.

Why it matters to the business

Linux systems may experience kernel instability, crashes, or potential memory corruption when connecting displays or devices that supply malformed EDID data, increasing operational risk on graphics-heavy workloads.

How an attack unfolds

An attacker presents a display or device with a crafted EDID that fails validation in the first block; the kernel invokes connector_bad_edid() without having expanded the allocation, allowing the function to read past the actual num_blocks limit and trigger memory safety issues.

How to fix it

Apply the upstream kernel patch that adds the num_blocks bounds check inside connector_bad_edid(); rebuild and deploy the fixed kernel on all affected Linux distributions.

How to confirm the fix worked

Inspect the drm/edid.c source for the added bounds check against num_blocks before accessing edid extensions; verify the running kernel contains the commit and test with intentionally corrupted first-block EDID data.

Typical attack path

1. Connect a display or input device advertising a malformed EDID
2. Force an EDID read error during the first block
3. Invoke connector_bad_edid() with num_blocks smaller than the assumed size
4. Trigger out-of-bounds read or memory corruption in kernel space

How to detect it

Review kernel logs for EDID-related oops, warnings, or panics during display initialization; correlate with recent hardware hot-plug events.

What your security team should do

• Prioritize kernel updates containing the EDID bounds fix on all Linux hosts
• Restrict untrusted display connections on high-value systems until patched
• Monitor vendor kernel update channels for backported fixes