CVE-2026-68277
NoneCVSS
—
EPSS
0.2%
Published
Aug 10, 2026
CISA due date
—
Cloudanix analysis
A bug in handling certain display connection messages on Linux could let a local attacker read small amounts of kernel memory they should not see.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Data Exposure
- Component
- OS kernel
- Class
- Memory Corruption
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Out-of-bounds memory read when three DisplayPort MST sideband reply parsers read 16-bit fields by indexing one byte past the end of the received message buffer into adjacent struct fields (curchunk_len, curchunk_idx, curlen) because bounds are checked only after the access.
Why it matters to the business
Low-probability local kernel memory disclosure on Linux systems with DisplayPort MST hardware; limited operational impact due to lack of known exploitation and very low exploit probability.
How an attack unfolds
An attacker with local access or the ability to trigger MST sideband reply parsing sends or induces a reply message whose length causes idx to equal curlen; the subsequent two-byte read then accesses memory beyond the message buffer, disclosing kernel data from the following struct fields.
How to fix it
Apply the upstream fix that performs a single combined bounds check (idx + 2 > curlen) before each two-byte read; rebuild and deploy the patched kernel on all affected Linux systems.
How to confirm the fix worked
Confirm the patch is present by inspecting the three affected functions for the combined pre-read bounds check; run kernel self-tests or MST emulation that exercises the sideband reply paths with short messages.
Typical attack path
- Obtain local execution or control over a DisplayPort MST source/sink that triggers sideband reply parsing
- Craft or induce an MST sideband reply whose payload length leaves insufficient bytes for a 2-byte field read
- Invoke one of the three affected parse functions (enum_path_resources_ack, allocate_payload_ack, query_payload_ack)
- Read the leaked kernel memory from the adjacent struct fields
How to detect it
Review kernel logs for unexpected page faults or oops during drm_dp_sideband_parse calls; examine audit or syscall logs for unusual MST-related ioctls; no public exploit artifacts exist.
What your security team should do
- Prioritize kernel updates on any systems exposing DisplayPort MST functionality
- Monitor EPSS and KEV status for changes given the memory-corruption family
- Restrict untrusted local access on multi-user systems until patched
The record
In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Three sideband reply parsers read 16-bit fields as: val = (raw->msg[idx] << 8) | (raw->msg[idx+1]); and check bounds only after the fact. When idx == raw->curlen, raw->msg[idx+1] reads one byte past the received message data into the following struct fields (curchunk_len, curchunk_idx, curlen). Affected functions: - drm_dp_sideband_parse_enum_path_resources_ack() full_payload_bw_number and avail_payload_bw_number fields - drm_dp_sideband_parse_allocate_payload_ack() allocated_pbn field - drm_dp_sideband_parse_query_payload_ack() allocated_pbn field Fix by using a single combined check (idx + 2 > curlen) before each 2-byte read. Since the check is strictly tighter than idx > curlen, no separate step is needed. [added fixes tag]
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|