AUGUST 22, 2026
Live Feed
Back to database
Case File

CVE-2026-68279

UNKNOWN · CVSS N/A EPSS 0.18%

Source: NVD + CISA KEV + EPSS · Published 2026-08-10 · Last synced 2026-08-22

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's handling of remote DPCD and I2C sideband reply parsers, specifically in the `drm_dp_sideband_parse_remote_dpcd_read()` and `drm_dp_sideband_parse_remote_i2c_read_ack()` functions, which can lead to out-of-bounds reads due to inadequate checks on the length of data being processed. This flaw allows a malicious MST hub to exploit the memcpy operation, potentially exposing sensitive information or causing unintended behavior in the system. Organizations utilizing Linux-based systems, particularly those leveraging DisplayPort MST technology, should prioritize applying the relevant patches to mitigate this risk.

CVE
CVE-2026-68279
Severity
UNKNOWN
CVSS
N/A
EPSS
0.18%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers drm_dp_sideband_parse_remote_dpcd_read() reads num_bytes from the raw message and then unconditionally does: memcpy(bytes, &raw->msg[idx], num_bytes); without checking that idx + num_bytes <= raw->curlen. raw->msg[] is 256 bytes; if a malicious or misbehaving MST hub sets num_bytes larger than the remaining payload, the memcpy reads past the received data into whatever follows in raw->msg[]. drm_dp_sideband_parse_remote_i2c_read_ack() has the same flaw (noted with a /* TODO check */ comment since the code was introduced). Fix both functions by using a single combined check (idx + num_bytes > curlen) before each memcpy. Since num_bytes is u8, it is always >= 0, so this strictly subsumes the simpler idx > curlen form and no separate step is needed. [added missing fixes tag]