Look up another CVE · open CVE-2026-64219 in the interactive tracker
CVE-2026-64219
drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async
Published 2026-07-24 (3 months ago) by the Linux kernel CNA. Subsystem drivers/gpu. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-64219 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.176-1 | Update the kernel and reboot. Fixed in 6.1.176-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.94-1 | Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
[Why&How] dc_process_dmub_aux_transfer_async() copies payload->length bytes into a 16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(), which is a no-op in release builds. If a caller ever passes length > 16 this results in a stack buffer overflow via memcpy. Additionally, link_index is used to dereference dc->links[] without bounds checking against dc->link_count, risking an out-of-bounds access. Replace the ASSERT with a hard runtime check that returns false when payload->length exceeds the destination buffer size, and add a bounds check for link_index before it is used. (cherry picked from commit ba4caa9fecdf7a38f98c878ad05a8a64148b6881)
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/gpu/drm/amd/display/dc/core/dc.c
- What this is
- AMD DISPLAY COREMAINTAINERS section matched on drivers/gpu/drm/amd/display/ · amd-gfx@lists.freedesktop.org · Supported
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-07-24 (3 months ago)source
- CVSS
- 7.0 high
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.14%, higher than 2.7% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/gpu
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.13 | 5.15.209 | d6590e3f766e |
| 5.13 | 6.1.175 | 16a5fa57565a |
| 5.13 | 6.6.142 | 90c398e822ca |
| 5.13 | 6.12.92 | 3265f3ed373f |
| 5.13 | 6.18.34 | 1ecde19bfce6 |
| 5.13 | 7.0.11 | 1c8c6e912f29 |
| 5.13 | 7.1 | 6c92f6d9600e |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The closest attack surface is the local DRM DisplayPort AUX character-device path; no network protocol reaches this function. Physical USB4/DisplayPort devices can initiate AUX activity but cannot directly supply the vulnerable length or index.
- AC:HAttack complexity, high
- All current callers cap transactions at 16 bytes, while link_index is derived from an internally created dc_link. Exploitation therefore requires an abnormal internal caller or corrupted state that the attacker cannot directly create.
- PR:LPrivileges required, low
- Reaching the relevant DRM/AUX interfaces requires local device access, but the traced path contains no administrative capability or init-namespace privilege check. Basic session or device-ACL access is therefore sufficient.
- UI:NUser interaction, none
- Once the attacker has local device access and the required abnormal state exists, the vulnerable copy or dereference executes without further victim action.
- S:UScope, unchanged
- The corruption occurs within the host kernel and does not inherently cross a separate virtualization, IOMMU, or other security authority boundary.
- C:HConfidentiality impact, high
- A length greater than 40 can copy payload-controlled bytes beyond the 64-byte stack command and overwrite control data. Successful control-flow hijacking would permit arbitrary kernel-memory disclosure.
- I:HIntegrity impact, high
- The unbounded stack write can overwrite saved state and potentially enable kernel code execution; an invalid link_index can also dereference a wild pointer. This supports complete integrity impact.
- A:HAvailability impact, high
- FORTIFY converts a sufficiently large copy into a kernel panic, while unfortified stack corruption, stack-canary failure, or the unchecked link dereference can cause an oops or crash.