Executive brief
A vulnerability in the Linux kernel's Hyper-V graphics driver could allow a malicious host or a compromised hypervisor to cause a system crash or memory corruption in a guest virtual machine. The issue occurs when the system processes video resolution data, potentially leading to an out-of-bounds memory access. This could impact the stability and availability of Linux virtual machines running on Hyper-V environments.
Technical details
An out-of-bounds read/write vulnerability exists in the Linux kernel's drm/hyperv driver within the hyperv_get_supported_resolution function. A SYNTHVID_RESOLUTION_RESPONSE message with a resolution_count exceeding 64 (SYNTHVID_MAX_RESOLUTION_COUNT) causes the parse loop to walk past the end of the supported_resolution array. Additionally, a logic error in hyperv_connect_vsp() could leave screen dimensions unpopulated (set to 0) if a resolution probe fails, causing subsequent framebuffer creation requests from userspace to be rejected. The fix introduces bounds checking on the resolution_count and ensures proper fallback to Windows 8 default resolutions.
Affected products
- Linux Linux 5.14 to 5.15.210, 6.1.176, 6.6.x, 6.9.x
Timeline
- 2026-05-19: other: Vulnerability fixed in upstream commits
- 2026-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/13d33b9ef67066c77c84273fac5a1d3fde3533d1
- https://git.kernel.org/stable/c/1fb565b77b8f44afabb02de6310065f109d89e94
- https://git.kernel.org/stable/c/8a114b25b5521eae451b13bce98ae978624962e5
- https://git.kernel.org/stable/c/96f7de3172d4aa878b7f87173b2b3507c350fcd6
- https://git.kernel.org/stable/c/9c698b2c43c2667c34f5336bf46ad5786216ac2a
- https://git.kernel.org/stable/c/a321c908f2eeea01539668eb270d074d9b88e490
- https://git.kernel.org/stable/c/bc573752f3dac0d1ab8df7078c1851bc76717653