CVE-2026-53329

drm/amd/display: Use krealloc_array() in dal_vector_reserve()

State: Published
Severity: 7.0 High
Published: Jul 1, 2026
Updated: Oct 19, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Use krealloc_array() in dal_vector_reserve()

[Why & How] dal_vector_reserve() computes the allocation size as "capacity * vector->struct_size" using uint32_t arithmetic, which can silently wrap to a small value on overflow. This would cause krealloc to return a smaller buffer than expected, leading to heap overflows on subsequent vector appends.

Replace krealloc() with krealloc_array() which performs an internal overflow check and returns NULL on wrap, preventing the issue.

(cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609dd5707)

Scores

CVSS	Score	Vector	Source
3.1	7.0 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-190 Integer Overflow or Wraparound

Affected Products

Product	Versions
LinuxLinux	2004f45ef83f07f43f5da6ede780b08068c7583d to before 9540b0a4d13e4ede64ae1197d66a176d2149daa9Affected 2004f45ef83f07f43f5da6ede780b08068c7583d to before 31180638a33acad12c863132704a76536fb66211Affected 2004f45ef83f07f43f5da6ede780b08068c7583d to before b15825deac1acff72638bbc8f05b89ceef8dfb13Affected 2004f45ef83f07f43f5da6ede780b08068c7583d to before 201151e120f0062bcda21cad5d007b82725ad23bAffected 2004f45ef83f07f43f5da6ede780b08068c7583d to before a914aa802669e073f014dae2e5708633b5cecd34Affected 2004f45ef83f07f43f5da6ede780b08068c7583d to before e09689286385a66311ac6922af95339d7a3cef8dAffected 2004f45ef83f07f43f5da6ede780b08068c7583d to before de988c7a31f0774f07894cfe4802996f318e2870Affected 2004f45ef83f07f43f5da6ede780b08068c7583d to before da48bc4461b8a5ebfb9264c9b191a701d8e99009Affected
LinuxLinux	4.15Affected before 4.15Not affected 5.10.260 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.94 through 6.12.Not affected 6.18.36 through 6.18.Not affected 7.0.13 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

2004f45ef83f07f43f5da6ede780b08068c7583d to before 9540b0a4d13e4ede64ae1197d66a176d2149daa9Affected
2004f45ef83f07f43f5da6ede780b08068c7583d to before 31180638a33acad12c863132704a76536fb66211Affected
2004f45ef83f07f43f5da6ede780b08068c7583d to before b15825deac1acff72638bbc8f05b89ceef8dfb13Affected
2004f45ef83f07f43f5da6ede780b08068c7583d to before 201151e120f0062bcda21cad5d007b82725ad23bAffected
2004f45ef83f07f43f5da6ede780b08068c7583d to before a914aa802669e073f014dae2e5708633b5cecd34Affected
2004f45ef83f07f43f5da6ede780b08068c7583d to before e09689286385a66311ac6922af95339d7a3cef8dAffected
2004f45ef83f07f43f5da6ede780b08068c7583d to before de988c7a31f0774f07894cfe4802996f318e2870Affected
2004f45ef83f07f43f5da6ede780b08068c7583d to before da48bc4461b8a5ebfb9264c9b191a701d8e99009Affected

LinuxLinux

4.15Affected
before 4.15Not affected
5.10.260 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.94 through 6.12.*Not affected
6.18.36 through 6.18.*Not affected
7.0.13 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.