---
id: CVE-2026-64524
title: 'drm/hyperv: validate resolution_count and fix WIN8 fallback'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/hyperv: validate resolution_count and fix WIN8 fallback

  A SYNTHVID_RESOLUTION_RESPONSE with resolution_count > 64 walks past
  the supported_resolution[SYNTHVID_MAX_…
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 76c56a5affeba1e163b66b9d8cc192e6154466f0 <
    96f7de3172d4aa878b7f87173b2b3507c350fcd6
  - >-
    Linux >= 76c56a5affeba1e163b66b9d8cc192e6154466f0 <
    bc573752f3dac0d1ab8df7078c1851bc76717653
  - >-
    Linux >= 76c56a5affeba1e163b66b9d8cc192e6154466f0 <
    1fb565b77b8f44afabb02de6310065f109d89e94
  - >-
    Linux >= 76c56a5affeba1e163b66b9d8cc192e6154466f0 <
    a321c908f2eeea01539668eb270d074d9b88e490
  - >-
    Linux >= 76c56a5affeba1e163b66b9d8cc192e6154466f0 <
    9c698b2c43c2667c34f5336bf46ad5786216ac2a
  - >-
    Linux >= 76c56a5affeba1e163b66b9d8cc192e6154466f0 <
    8a114b25b5521eae451b13bce98ae978624962e5
  - >-
    Linux >= 76c56a5affeba1e163b66b9d8cc192e6154466f0 <
    13d33b9ef67066c77c84273fac5a1d3fde3533d1
  - Linux 5.14
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T15:41:39.558295Z'
published: '2026-07-25'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:39.416Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64524'
references:
  - url: 'https://git.kernel.org/stable/c/96f7de3172d4aa878b7f87173b2b3507c350fcd6'
  - url: 'https://git.kernel.org/stable/c/bc573752f3dac0d1ab8df7078c1851bc76717653'
  - url: 'https://git.kernel.org/stable/c/1fb565b77b8f44afabb02de6310065f109d89e94'
  - url: 'https://git.kernel.org/stable/c/a321c908f2eeea01539668eb270d074d9b88e490'
  - url: 'https://git.kernel.org/stable/c/9c698b2c43c2667c34f5336bf46ad5786216ac2a'
  - url: 'https://git.kernel.org/stable/c/8a114b25b5521eae451b13bce98ae978624962e5'
  - url: 'https://git.kernel.org/stable/c/13d33b9ef67066c77c84273fac5a1d3fde3533d1'
tags:
  - cve.org
epss: 0.00142
epssPercentile: 0.03118
ingestedAt: '2026-10-16T17:24:46.825Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/hyperv: validate resolution_count and fix WIN8 fallback

A SYNTHVID_RESOLUTION_RESPONSE with resolution_count > 64 walks past
the supported_resolution[SYNTHVID_MAX_RESOLUTION_COUNT] array in the
parse loop. Bound resolution_count against the array size, folded
into the existing zero-check.

When the WIN10 resolution probe fails, the caller in
hyperv_connect_vsp() left hv->screen_*_max / preferred_* unpopulated,
which sets mode_config.max_width / max_height to 0 and makes
drm_internal_framebuffer_create() reject every userspace framebuffer
with -EINVAL. The pre-WIN10 branch had the same gap for
preferred_width / preferred_height. Use a single post-probe fallback
guarded by screen_width_max == 0 so both paths converge on the WIN8
defaults.

## Affected

- `Linux >= 76c56a5affeba1e163b66b9d8cc192e6154466f0 < 96f7de3172d4aa878b7f87173b2b3507c350fcd6`
- `Linux >= 76c56a5affeba1e163b66b9d8cc192e6154466f0 < bc573752f3dac0d1ab8df7078c1851bc76717653`
- `Linux >= 76c56a5affeba1e163b66b9d8cc192e6154466f0 < 1fb565b77b8f44afabb02de6310065f109d89e94`
- `Linux >= 76c56a5affeba1e163b66b9d8cc192e6154466f0 < a321c908f2eeea01539668eb270d074d9b88e490`
- `Linux >= 76c56a5affeba1e163b66b9d8cc192e6154466f0 < 9c698b2c43c2667c34f5336bf46ad5786216ac2a`
- `Linux >= 76c56a5affeba1e163b66b9d8cc192e6154466f0 < 8a114b25b5521eae451b13bce98ae978624962e5`
- `Linux >= 76c56a5affeba1e163b66b9d8cc192e6154466f0 < 13d33b9ef67066c77c84273fac5a1d3fde3533d1`
- `Linux 5.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.