CVE-2026-53135

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs<br /> <br /> [Why &amp; How]<br /> dp_sdp_message_debugfs_write() dereferences connector-&gt;base.state-&gt;crtc<br /> without checking for NULL. A connector can be connected but not bound to<br /> any CRTC (e.g. after hot-plug before the next atomic commit), causing a<br /> kernel crash when writing to the sdp_message debugfs node.<br /> <br /> The function also ignores the user-provided size argument and always<br /> passes 36 bytes to copy_from_user(), reading past the user buffer when<br /> size base.state or state-&gt;crtc is NULL<br /> - Clamping write_size to min(size, sizeof(data))<br /> <br /> (cherry picked from commit 6ab4c36a522842ff70474a1c0af2e40e50fc8300)