High 7.0Published Jul 24, 2026

CVE-2026-64219drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async

Updated under an hour ago (Oct 27, 2026, 8:50 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async [Why&How] dc_process_dmub_aux_transfer_async() copies payload->length bytes into a 16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(), which is a no-op in release builds. If a caller ever passes length > 16 this results in a stack buffer overflow via memcpy. Additionally, link_index is used to dereference dc->links[] without bounds checking against dc->link_count, risking an out-of-bounds access. Replace the ASSERT with a hard runtime check that returns false when payload->length exceeds the destination buffer size, and add a bounds check for link_index before it is used. (cherry picked from commit ba4caa9fecdf7a38f98c878ad05a8a64148b6881)

CVSS: 7.0 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-121
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 before d6590e3f766e3111dd1beaf88b9384d117acfa6b; from 4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 before 16a5fa57565afb6bf37e18129921c270c93d8e2b; from 4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 before 90c398e822ca76e40548df0c061dd4f93ea92d71; from 4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 before 3265f3ed373fb8048be713aadcdf702579a0e53d; 4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 builds before 1ecde19bfce6535bffddad1139ff466b6d401b8e; 4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 builds before 1c8c6e912f2945b2a3e669afca6b52174b88e86e; from 4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 before 6c92f6d9600efa3ef0d9e560a2b52776d9803c29	CNA record
linux linux_kernel linux:linux_kernel	from 5.13 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.142; from 6.7 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1; 7.1; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/d6590e3f766e3111dd1beaf88b9384d117acfa6b	patch
https://git.kernel.org/stable/c/16a5fa57565afb6bf37e18129921c270c93d8e2b	patch
https://git.kernel.org/stable/c/90c398e822ca76e40548df0c061dd4f93ea92d71	patch
https://git.kernel.org/stable/c/3265f3ed373fb8048be713aadcdf702579a0e53d	patch
https://git.kernel.org/stable/c/1ecde19bfce6535bffddad1139ff466b6d401b8e	patch
https://git.kernel.org/stable/c/1c8c6e912f2945b2a3e669afca6b52174b88e86e	patch
https://git.kernel.org/stable/c/6c92f6d9600efa3ef0d9e560a2b52776d9803c29	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.