CVE-2026-64219

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async<br /> <br /> [Why&amp;How]<br /> dc_process_dmub_aux_transfer_async() copies payload-&gt;length bytes into a<br /> 16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(), which<br /> is a no-op in release builds. If a caller ever passes length &gt; 16 this<br /> results in a stack buffer overflow via memcpy.<br /> <br /> Additionally, link_index is used to dereference dc-&gt;links[] without<br /> bounds checking against dc-&gt;link_count, risking an out-of-bounds access.<br /> <br /> Replace the ASSERT with a hard runtime check that returns false when<br /> payload-&gt;length exceeds the destination buffer size, and add a bounds<br /> check for link_index before it is used.<br /> <br /> (cherry picked from commit ba4caa9fecdf7a38f98c878ad05a8a64148b6881)