Executive brief
The Linux kernel's DRM display driver contains a memory safety bug in HDMI audio infoframe handling. A helper function reads 60 bytes from a 28-byte buffer when copying audio configuration data to the display connector, risking reading uninitialized or protected memory. While unlikely to corrupt data, an exploit could cause a system crash if the read extends across a page boundary.
Technical details
The vulnerability is a buffer over-read in the drm_atomic_helper_connector_hdmi_update_audio_infoframe() function within drivers/gpu/drm/display/drm_hdmi_state_helper.c. The function calls memcpy() using sizeof(infoframe->data) (60 bytes) as the copy size instead of sizeof(*frame) (28 bytes), reading 32 extra bytes from a source buffer not designed to provide that much data. This is a read-only operation with no direct memory corruption, but reading beyond allocated memory can trigger page faults or expose sensitive kernel data. Local code execution is required to trigger this path (likely during HDMI display setup), and the patch adds a BUILD_BUG_ON() check and corrects the memcpy size parameter. The fix was committed upstream and backported to stable kernels v6.11+.
Affected products
- Linux Linux Kernel v6.11 and later
Timeline
- 2026-09-03: disclosed
- 2026-07-23: patched: Fix committed by John Harrison