Look up another CVE · open CVE-2026-80749 in the interactive tracker
CVE-2026-80749
drm/connector/hdmi: Fix out of bounds memory read
Published 2026-09-03 (2 months ago) by the Linux kernel CNA. Subsystem drivers/gpu. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-80749 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixed | 6.12.105-1 | Update the kernel and reboot. Fixed in 6.12.105-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.10-1 | Update the kernel and reboot. Fixed in 7.1.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.10-1 | Update the kernel and reboot. Fixed in 7.1.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4788-1 · 2026-09-19 · text | 6.12.107-1~deb12u1 | Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
A helper function was copying a given audio infoframe into the connector's copy but using the size of the destination (a generic target, sized to accept many different data blocks) not the source (a very specific type of data block). Thus, it was copying 60 bytes of data from a 28 byte allocation. Fix that by using the source size instead, together with a build bug on the source size actually being smaller than the destination. I hit this running KUnit tests under KASAN (while debugging something else entirely). In the real world, it seems unlikely to cause an actual problem. It is a read not a write so it can't corrupt any memory. However, it could potentially fall off the end of a page and cause an accvio bug.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/gpu/drm/display/drm_hdmi_state_helper.c
- What this is
- DRM DRIVERS AND MISC GPU PATCHESMAINTAINERS section matched on drivers/gpu/drm/ · Maintained
- Kernel module
- drm_display_helper
Check it on the machine
grep -wE 'CONFIG_DRM_DISPLAY_HDMI_STATE_HELPER|CONFIG_DRM_DISPLAY_HELPER' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w drm_display_helperPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed. The build rule could not be established for 1 release, so nothing is claimed about those.
- bookworm?
- trixieMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/cloud-arm64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, riscv64/riscv64, s390x/s390x
- forky, sidMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt-amd64, arm64/cloud-arm64, loong64/loong64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, s390x/s390x
- bookworm · linux-6.12Mnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/cloud-arm64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k
- ?
- not established - no Makefile entry for the affected file
- M
- a module where it is built at all; some flavours do not build it
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
- Build switches
- CONFIG_DRM_DISPLAY_HDMI_STATE_HELPER, CONFIG_DRM_DISPLAY_HELPER
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-03 (2 months ago)source
- CVSS
- 7.1 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.12%, higher than 1.5% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/gpu
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.11 | 6.12.105 | d9f7454c185c |
| 6.11 | 6.18.46 | e5b527804a1e |
| 6.11 | 7.1.10 | f72bb95732bc |
| 6.11 | 7.2 | 9ecf8ba763d0 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4788-1 | 2026-09-19 | bookworm 6.12.107-1~deb12u1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is reached only via the ALSA PCM prepare path (SNDRV_PCM_IOCTL_PREPARE) through hdmi-codec into DRM HDMI audio prepare callbacks; it is not reachable from network protocols or remote packet handling.
- AC:LAttack complexity, low
- Any local caller that can prepare HDMI audio reliably hits the faulty memcpy on every invocation; no special memory layout, timing window, or rare kernel configuration is required beyond having a supported HDMI audio driver loaded.
- PR:LPrivileges required, low
- Triggering the path requires only access to ALSA PCM devices (/dev/snd/pcm*) to start HDMI audio playback, which typical unprivileged desktop, mobile, and embedded users already have without real root or init-namespace capabilities.
- UI:NUser interaction, none
- Exploitation is self-contained: the attacker prepares or starts HDMI audio playback themselves and does not depend on a separate victim performing an additional action beyond normal attacker-controlled playback setup.
- S:UScope, unchanged
- Impact is confined to kernel memory read and possible local kernel fault within the same privilege domain; it does not cross VM, IOMMU, or sandbox boundaries into another security authority.
- C:HConfidentiality impact, high
- The vulnerable memcpy reads 60 bytes from a 28-byte hdmi_audio_infoframe, causing a 32-byte out-of-bounds kernel stack read whose contents are copied into connector state; OOB reads are rated High unless strictly limited to a few bytes.
- I:NIntegrity impact, none
- This is an out-of-bounds read, not an out-of-bounds write or use-after-free; kernel memory is not corrupted and no arbitrary write or control-flow hijack primitive is created, only mis-sized copying into an intended destination buffer.
- A:HAvailability impact, high
- The over-read can cross a page boundary and fault (as noted by the fix author), producing a kernel oops/access violation; any kernel crash from memory access violations is rated High availability impact.