drm/amd/display: Implement bounds check for stream encoder creation in DCN301

Summary

CVE	CVE-2024-26660
State	PUBLISHED
Assigner	Linux
Source Priority	CVE Program / NVD first with legacy fallback
Published	2024-04-02 07:15:43 UTC
Updated	2026-08-04 11:16:54 UTC
Description	In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Implement bounds check for stream encoder creation in DCN301 'stream_enc_regs' array is an array of dcn10_stream_enc_registers structures. The array is initialized with four elements, corresponding to the four calls to stream_enc_regs() in the array initializer. This means that valid indices for this array are 0, 1, 2, and 3. The error message 'stream_enc_regs' 4 <= 5 below, is indicating that there is an attempt to access this array with an index of 5, which is out of bounds. This could lead to undefined behavior Here, eng_id is used as an index to access the stream_enc_regs array. If eng_id is 5, this would result in an out-of-bounds access on the stream_enc_regs array. Thus fixing Buffer overflow error in dcn301_stream_encoder_create reported by Smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn301/dcn301_resource.c:1011 dcn301_stream_encoder_create() error: buffer overflow 'stream_enc_regs' 4 <= 5

Primary CVSS: v3.1 5.5 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Problem Types: CWE-125

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	5.5	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`
3.1	416baaa9-dc9f-4396-8d5f-8c081fb06d67	Secondary	7	HIGH	`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`
3.1	CNA	DECLARED	7	HIGH	`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Linux	Linux Kernel	All	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Linux	Linux	affected 3a83e4e64bb1522ddac67ffc787d1c38291e1a65 42442f74314d41ddc68227047036fa3e78940054 git	Not specified
CNA	Linux	Linux	affected 3a83e4e64bb1522ddac67ffc787d1c38291e1a65 efdd665ce1a1634b8c1dad5e7f6baaef3e131d0a git	Not specified
CNA	Linux	Linux	affected 3a83e4e64bb1522ddac67ffc787d1c38291e1a65 cd9bd10c59e3c1446680514fd3097c5b00d3712d git	Not specified
CNA	Linux	Linux	affected 3a83e4e64bb1522ddac67ffc787d1c38291e1a65 a938eab9586eea31cfd129a507f552efae14d738 git	Not specified
CNA	Linux	Linux	affected 3a83e4e64bb1522ddac67ffc787d1c38291e1a65 58fca355ad37dcb5f785d9095db5f748b79c5dc2 git	Not specified
CNA	Linux	Linux	affected 5.11	Not specified
CNA	Linux	Linux	unaffected 5.11 semver	Not specified
CNA	Linux	Linux	unaffected 5.15.149 5.15.* semver	Not specified
CNA	Linux	Linux	unaffected 6.1.78 6.1.* semver	Not specified
CNA	Linux	Linux	unaffected 6.6.17 6.6.* semver	Not specified
CNA	Linux	Linux	unaffected 6.7.5 6.7.* semver	Not specified
CNA	Linux	Linux	unaffected 6.8 * original_commit_for_fix	Not specified

Reference	Source	Link	Tags
git.kernel.org/stable/c/42442f74314d41ddc68227047036fa3e78940054	af854a3a-2127-422b-91ae-364da2661108	git.kernel.org	Patch
git.kernel.org/stable/c/a938eab9586eea31cfd129a507f552efae14d738	af854a3a-2127-422b-91ae-364da2661108	git.kernel.org	Patch
git.kernel.org/stable/c/cd9bd10c59e3c1446680514fd3097c5b00d3712d	af854a3a-2127-422b-91ae-364da2661108	git.kernel.org	Patch
git.kernel.org/stable/c/58fca355ad37dcb5f785d9095db5f748b79c5dc2	af854a3a-2127-422b-91ae-364da2661108	git.kernel.org	Patch
git.kernel.org/stable/c/efdd665ce1a1634b8c1dad5e7f6baaef3e131d0a	af854a3a-2127-422b-91ae-364da2661108	git.kernel.org	Patch
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.