CVE-2026-64219

drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async

State: Published
Severity: 7.0 High
Published: Jul 24, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async

[Why&How] dc_process_dmub_aux_transfer_async() copies payload->length bytes into a 16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(), which is a no-op in release builds. If a caller ever passes length > 16 this results in a stack buffer overflow via memcpy.

Additionally, link_index is used to dereference dc->links[] without bounds checking against dc->link_count, risking an out-of-bounds access.

Replace the ASSERT with a hard runtime check that returns false when payload->length exceeds the destination buffer size, and add a bounds check for link_index before it is used.

(cherry picked from commit ba4caa9fecdf7a38f98c878ad05a8a64148b6881)

Scores

CVSS	Score	Vector	Source
3.1	7.0 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-121 Stack-based Buffer Overflow

Affected Products

Product	Versions
LinuxLinux	4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 to before d6590e3f766e3111dd1beaf88b9384d117acfa6bAffected 4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 to before 16a5fa57565afb6bf37e18129921c270c93d8e2bAffected 4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 to before 90c398e822ca76e40548df0c061dd4f93ea92d71Affected 4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 to before 3265f3ed373fb8048be713aadcdf702579a0e53dAffected 4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 to before 1ecde19bfce6535bffddad1139ff466b6d401b8eAffected 4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 to before 1c8c6e912f2945b2a3e669afca6b52174b88e86eAffected 4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 to before 6c92f6d9600efa3ef0d9e560a2b52776d9803c29Affected
LinuxLinux	5.13Affected before 5.13Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.142 through 6.6.Not affected 6.12.92 through 6.12.Not affected 6.18.34 through 6.18.Not affected 7.0.11 through 7.0.Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 to before d6590e3f766e3111dd1beaf88b9384d117acfa6bAffected
4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 to before 16a5fa57565afb6bf37e18129921c270c93d8e2bAffected
4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 to before 90c398e822ca76e40548df0c061dd4f93ea92d71Affected
4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 to before 3265f3ed373fb8048be713aadcdf702579a0e53dAffected
4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 to before 1ecde19bfce6535bffddad1139ff466b6d401b8eAffected
4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 to before 1c8c6e912f2945b2a3e669afca6b52174b88e86eAffected
4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 to before 6c92f6d9600efa3ef0d9e560a2b52776d9803c29Affected

LinuxLinux

5.13Affected
before 5.13Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.142 through 6.6.*Not affected
6.12.92 through 6.12.*Not affected
6.18.34 through 6.18.*Not affected
7.0.11 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.