Medium 5.5Published Jun 25, 2026

CVE-2026-53135drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs

Updated under an hour ago (Oct 27, 2026, 11:30 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs [Why & How] dp_sdp_message_debugfs_write() dereferences connector->base.state->crtc without checking for NULL. A connector can be connected but not bound to any CRTC (e.g. after hot-plug before the next atomic commit), causing a kernel crash when writing to the sdp_message debugfs node. The function also ignores the user-provided size argument and always passes 36 bytes to copy_from_user(), reading past the user buffer when size < 36. Fix both issues by: - Returning -ENODEV when connector->base.state or state->crtc is NULL - Clamping write_size to min(size, sizeof(data)) (cherry picked from commit 6ab4c36a522842ff70474a1c0af2e40e50fc8300)

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jun 25, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from c7ba3653e9773256b2b08508a2ed2ca28ea7566b before ee9cfcf77a8e8af637396dc00966df5f701e661c; from c7ba3653e9773256b2b08508a2ed2ca28ea7566b before b781f90a9528555c709e59789550893581ef0be4; from c7ba3653e9773256b2b08508a2ed2ca28ea7566b before a2de1d71891a038a9346b2c1a72b88c8350f2479; from c7ba3653e9773256b2b08508a2ed2ca28ea7566b before 7fc4fab4acc307ad2903312c195872b2953d32c3; from c7ba3653e9773256b2b08508a2ed2ca28ea7566b before 7ae95c0275c330b5dbae806f8e431720edad776f; from c7ba3653e9773256b2b08508a2ed2ca28ea7566b before bb6f705b73b5f191f14ad004e2c8c4b615806187; from c7ba3653e9773256b2b08508a2ed2ca28ea7566b before c90954cdea4d6998ec345de0d840d030c145b89e; from c7ba3653e9773256b2b08508a2ed2ca28ea7566b before adf67034b1f61f7119295208085bfd43f85f56af	CNA record
linux linux_kernel linux:linux_kernel	from 5.2 before 5.10.259; from 5.11 before 5.15.210; from 5.16 before 6.1.176; from 6.2 before 6.6.143; from 6.7 before 6.12.94; from 6.13 before 6.18.36; from 6.19 before 7.0.13; 7.1; and 5 more ranges	NVD

References

References

https://git.kernel.org/stable/c/ee9cfcf77a8e8af637396dc00966df5f701e661c	patch
https://git.kernel.org/stable/c/b781f90a9528555c709e59789550893581ef0be4	patch
https://git.kernel.org/stable/c/a2de1d71891a038a9346b2c1a72b88c8350f2479	patch
https://git.kernel.org/stable/c/7fc4fab4acc307ad2903312c195872b2953d32c3	patch
https://git.kernel.org/stable/c/7ae95c0275c330b5dbae806f8e431720edad776f	patch
https://git.kernel.org/stable/c/bb6f705b73b5f191f14ad004e2c8c4b615806187	patch
https://git.kernel.org/stable/c/c90954cdea4d6998ec345de0d840d030c145b89e	patch
https://git.kernel.org/stable/c/adf67034b1f61f7119295208085bfd43f85f56af	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.