{"id":"CVE-2026-64546","title":"drm/edid: fix OOB read in drm_parse_tiled_block()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/edid: fix OOB read in drm_parse_tiled_block()\n\ndrm_parse_tiled_block() casts the DisplayID block to a\nstruct displayid_tiled_block and reads the full fixed layout u…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 40d9b043a89e2301e1f97ade055a73ecc28e9afe < c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0","Linux >= 40d9b043a89e2301e1f97ade055a73ecc28e9afe < 9acd5c1ddc17ca4c5ffa0c373e3fdf480506e061","Linux >= 40d9b043a89e2301e1f97ade055a73ecc28e9afe < 157727131ce8a52d8d9bc676c372ef82db6436c4","Linux >= 40d9b043a89e2301e1f97ade055a73ecc28e9afe < bfa05d89dc3ca3fb1a9099ef5185549a5ec8490d","Linux >= 40d9b043a89e2301e1f97ade055a73ecc28e9afe < 4f5484d25f85ad6c989bad5f6a43450cecfcfd28","Linux >= 40d9b043a89e2301e1f97ade055a73ecc28e9afe < 9cc0f8e63e8c34cf43def35cbd305ba711181a1f","Linux >= 40d9b043a89e2301e1f97ade055a73ecc28e9afe < 4137e1ecec9c8cb6c4fcee28ffabbbc7409eb7fb","Linux >= 40d9b043a89e2301e1f97ade055a73ecc28e9afe < faaa1e1155833e7d4ce7e3cfaf64c0d636b190db","Linux 3.19"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T15:42:17.796608Z"},"published":"2026-07-27","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:52:51.581Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64546","references":[{"url":"https://git.kernel.org/stable/c/c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0"},{"url":"https://git.kernel.org/stable/c/9acd5c1ddc17ca4c5ffa0c373e3fdf480506e061"},{"url":"https://git.kernel.org/stable/c/157727131ce8a52d8d9bc676c372ef82db6436c4"},{"url":"https://git.kernel.org/stable/c/bfa05d89dc3ca3fb1a9099ef5185549a5ec8490d"},{"url":"https://git.kernel.org/stable/c/4f5484d25f85ad6c989bad5f6a43450cecfcfd28"},{"url":"https://git.kernel.org/stable/c/9cc0f8e63e8c34cf43def35cbd305ba711181a1f"},{"url":"https://git.kernel.org/stable/c/4137e1ecec9c8cb6c4fcee28ffabbbc7409eb7fb"},{"url":"https://git.kernel.org/stable/c/faaa1e1155833e7d4ce7e3cfaf64c0d636b190db"}],"tags":["cve.org"],"epss":0.00126,"epssPercentile":0.02042,"ingestedAt":"2026-10-16T17:24:46.831Z","slug":"CVE-2026-64546","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/edid: fix OOB read in drm_parse_tiled_block()\n\ndrm_parse_tiled_block() casts the DisplayID block to a\nstruct displayid_tiled_block and reads the full fixed layout up to\ntile->topology_id[7] without checking block->num_bytes. The DisplayID\niterator only validates the declared payload length, so a crafted EDID\ncan advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or\nDATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at\nthe end of a DisplayID extension. The read then runs past the end of the\nexact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read.\n\nReject blocks shorter than the spec's 22-byte tiled payload before\nreading the fixed struct, as drm_parse_vesa_mso_data() already does.\n\n  BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update\n  Read of size 2 at addr ffff888010077700 by task exploit/147\n   dump_stack_lvl (lib/dump_stack.c:94 ...)\n   print_report (mm/kasan/report.c:378 ...)\n   kasan_report (mm/kasan/report.c:595)\n   drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581)\n   bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574)\n   drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426)\n   status_store (drivers/gpu/drm/drm_sysfs.c:219)\n   ...\n   vfs_write (fs/read_write.c:595 fs/read_write.c:688)\n   ksys_write (fs/read_write.c:740)\n\n## Affected\n\n- `Linux >= 40d9b043a89e2301e1f97ade055a73ecc28e9afe < c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0`\n- `Linux >= 40d9b043a89e2301e1f97ade055a73ecc28e9afe < 9acd5c1ddc17ca4c5ffa0c373e3fdf480506e061`\n- `Linux >= 40d9b043a89e2301e1f97ade055a73ecc28e9afe < 157727131ce8a52d8d9bc676c372ef82db6436c4`\n- `Linux >= 40d9b043a89e2301e1f97ade055a73ecc28e9afe < bfa05d89dc3ca3fb1a9099ef5185549a5ec8490d`\n- `Linux >= 40d9b043a89e2301e1f97ade055a73ecc28e9afe < 4f5484d25f85ad6c989bad5f6a43450cecfcfd28`\n- `Linux >= 40d9b043a89e2301e1f97ade055a73ecc28e9afe < 9cc0f8e63e8c34cf43def35cbd305ba711181a1f`\n- `Linux >= 40d9b043a89e2301e1f97ade055a73ecc28e9afe < 4137e1ecec9c8cb6c4fcee28ffabbbc7409eb7fb`\n- `Linux >= 40d9b043a89e2301e1f97ade055a73ecc28e9afe < faaa1e1155833e7d4ce7e3cfaf64c0d636b190db`\n- `Linux 3.19`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}