Executive brief
The Extron DA HD 4K Plus CEC driver in the Linux kernel did not validate the size of incoming malformed data, allowing a potential buffer overflow in the msg.msg[] array. An attacker able to send crafted CEC messages could trigger a kernel memory corruption, leading to a denial of service or potential code execution.
Technical details
A buffer overflow vulnerability exists in the extron_process_received() function in drivers/media/cec/usb/extron-da-hd-4k-plus/extron-da-hd-4k-plus.c. The code did not check whether the calculated message length would exceed the bounds of the msg.msg[] array before processing incoming CEC data. An attacker sending malformed CEC messages with an oversized length field could overflow the buffer. The fix adds a sanity check: ((len - 2) / 3 > sizeof(msg.msg)) to reject messages that would overflow the array. This is a local or adjacent network-reachable vulnerability depending on CEC bus accessibility.
Affected products
- Linux Linux kernel multiple versions prior to fix commit abac9820b26b5cfcb01eb79efe2abdd0ac7e07c3
Timeline
- 2026-09-16: disclosed
- 2026-09-14: patched: Fix committed upstream; backports to stable branches follow
- 2026-06-18: other: Patch authored by Hans Verkuil