drm/connector/hdmi: Fix out of bounds memory read
Summary
| CVE | CVE-2026-80749 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-03 13:06:14 UTC |
| Updated | 2026-09-04 05:17:14 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: drm/connector/hdmi: Fix out of bounds memory read A helper function was copying a given audio infoframe into the connector's copy but using the size of the destination (a generic target, sized to accept many different data blocks) not the source (a very specific type of data block). Thus, it was copying 60 bytes of data from a 28 byte allocation. Fix that by using the source size instead, together with a build bug on the source size actually being smaller than the destination. I hit this running KUnit tests under KASAN (while debugging something else entirely). In the real world, it seems unlikely to cause an actual problem. It is a read not a write so it can't corrupt any memory. However, it could potentially fall off the end of a page and cause an accvio bug. |
Risk And Classification
Primary CVSS: v3.1 7.1 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
EPSS: 0.001590000 probability, percentile 0.053420000 (date 2026-09-07)
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | Secondary | 7.1 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
| 3.1 | CNA | DECLARED | 7.1 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected f378b77227bc4732922c57f92be89438bb1018a1 d9f7454c185c0c7f0973e11d62ad6c06862c324c git | Not specified |
| CNA | Linux | Linux | affected f378b77227bc4732922c57f92be89438bb1018a1 e5b527804a1ea4f70e139179d3062cf5de8c06ab git | Not specified |
| CNA | Linux | Linux | affected f378b77227bc4732922c57f92be89438bb1018a1 f72bb95732bc5ca87b50c52c8f087ba501950809 git | Not specified |
| CNA | Linux | Linux | affected f378b77227bc4732922c57f92be89438bb1018a1 9ecf8ba763d0ffe0673538eb4bf7806f20455d19 git | Not specified |
| CNA | Linux | Linux | affected 6.11 | Not specified |
| CNA | Linux | Linux | unaffected 6.11 semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.105 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.46 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.1.10 7.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.2 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/d9f7454c185c0c7f0973e11d62ad6c06862c324c | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/f72bb95732bc5ca87b50c52c8f087ba501950809 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/9ecf8ba763d0ffe0673538eb4bf7806f20455d19 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/e5b527804a1ea4f70e139179d3062cf5de8c06ab | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.