Executive brief
A vulnerability was identified in the Linux kernel's display driver component that handles monitor identification data (EDID). By providing a specially crafted display identification block, an attacker could cause the system to read memory outside of intended boundaries. This could lead to system instability, crashes, or potentially the exposure of sensitive information from the computer's memory.
Technical details
The vulnerability is a heap out-of-bounds read in the drm_parse_tiled_block() function within drivers/gpu/drm/drm_edid.c. The function casts a DisplayID block to a struct displayid_tiled_block and reads its fixed 22-byte layout without verifying if block->num_bytes is sufficient. An attacker can provide a crafted EDID with a truncated tiled-display block (DATA_BLOCK_TILED_DISPLAY or DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY) at the end of a DisplayID extension, causing the kernel to read past the kmemdup()'d allocation. This was identified via KASAN as a slab-out-of-bounds read. The fix involves validating that the block contains at least the 22-byte payload required by the specification before parsing.
Affected products
- Linux Linux Kernel 40d9b043a89e to c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0
Timeline
- 2026-06-15: disclosed: Patch submitted by Xiang Mei
- 2026-07-24: patched: Commits merged into stable branches
- 2026-07-27: advisory: NVD publication of CVE-2026-64546
References
- https://git.kernel.org/stable/c/157727131ce8a52d8d9bc676c372ef82db6436c4
- https://git.kernel.org/stable/c/4137e1ecec9c8cb6c4fcee28ffabbbc7409eb7fb
- https://git.kernel.org/stable/c/4f5484d25f85ad6c989bad5f6a43450cecfcfd28
- https://git.kernel.org/stable/c/9acd5c1ddc17ca4c5ffa0c373e3fdf480506e061
- https://git.kernel.org/stable/c/9cc0f8e63e8c34cf43def35cbd305ba711181a1f
- https://git.kernel.org/stable/c/bfa05d89dc3ca3fb1a9099ef5185549a5ec8490d
- https://git.kernel.org/stable/c/c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0