Executive brief
The Linux kernel's tc358767 DRM bridge driver contains a buffer overflow vulnerability in its AUX (Auxiliary channel) read handling. A malicious or faulty display controller could report an inflated byte count, causing the driver to read beyond allocated buffer boundaries. This could lead to information disclosure or kernel crash on systems using this display bridge hardware.
Technical details
The tc_aux_transfer() function in the tc358767 bridge driver fails to validate the AUX_BYTES field returned by the hardware controller. The code clamps the initial request size to DP_AUX_MAX_PAYLOAD_BYTES - 1, but then unconditionally replaces this value with the hardware-reported AUX_BYTES count (GENMASK(15, 8), up to 255). The subsequent tc_aux_read_data() call reads this many bytes into a 16-byte stack buffer, causing a buffer overrun. The fix clamps the reported byte count back to the original request size using min_t(), following the pattern used in the ti-sn65dsi86 driver. This is a defensive fix addressing untrusted controller output rather than an actively exploited vulnerability.
Affected products
- Linux Linux kernel 5.0 through 6.x (affected by commit 12dfe7c4d9c5, fixed in later versions)
Timeline
- 2026-09-17: disclosed
- 2026-07-01: patched: Upstream patch commit ec6444a00c49e6c2b5e9a507272a28126677f9ee