---
id: CVE-2026-68278
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/dp/mst: fix buffer overflows in sideband chunk accumulation

  drm_dp_sideband_append_payload() has three related bugs when processing
  device-provided sideband reply …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/dp/mst: fix buffer overflows in sideband chunk accumulation

  drm_dp_sideband_append_payload() has three related bugs when processing
  device-provided sideband reply …
severity: none
published: '2026-08-10'
updated: '2026-08-23'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-68278'
references:
  - url: 'https://git.kernel.org/stable/c/1e5827839ad0ceb0079d1560c321fa3656b54f21'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4d5109075a787de28c9e89940f9dee45269f91fa'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/53937a2787d29c7a460e984dc4f20ff6ac91dc65'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/55bd5e685bda455b9b50c835f8c8442d52a344a3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a6366b551079c79bf7bdbadd74c97358bcfe2d58'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d4e05dedb252ed3e540a0c9be511e427f098110a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ef0dbcc200c3389f1f781ab181932a97e54b51af'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ef2ecb6cf268debf3890df99fea01b6452dcf78e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00238
epssPercentile: 0.13296
ingestedAt: '2026-08-23T13:48:06.902Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/dp/mst: fix buffer overflows in sideband chunk accumulation

drm_dp_sideband_append_payload() has three related bugs when processing
device-provided sideband reply data:

1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken
   directly from the DP sideband header. If a device sends msg_len=0,
   curchunk_len is set to zero. The condition (curchunk_idx >= curchunk_len)
   is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow).
   drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy()
   writes 255 bytes into msg[], both far out of bounds.

2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is
   only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks
   until curchunk_idx reaches curchunk_len, writing up to 15 bytes past
   the end of chunk[] into msg[].

3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to
   msg[]. No check ensures curlen + (curchunk_len-1) stays within msg[256],
   so the memcpy can spill into adjacent struct fields.

All three are reachable from any DP MST device that can forge sideband
reply messages on a physical connection.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.