CVE-2026-68278

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/dp/mst: fix buffer overflows in sideband chunk accumulation<br /> <br /> drm_dp_sideband_append_payload() has three related bugs when processing<br /> device-provided sideband reply data:<br /> <br /> 1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken<br /> directly from the DP sideband header. If a device sends msg_len=0,<br /> curchunk_len is set to zero. The condition (curchunk_idx &gt;= curchunk_len)<br /> is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow).<br /> drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy()<br /> writes 255 bytes into msg[], both far out of bounds.<br /> <br /> 2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is<br /> only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks<br /> until curchunk_idx reaches curchunk_len, writing up to 15 bytes past<br /> the end of chunk[] into msg[].<br /> <br /> 3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to<br /> msg[]. No check ensures curlen + (curchunk_len-1) stays within msg[256],<br /> so the memcpy can spill into adjacent struct fields.<br /> <br /> All three are reachable from any DP MST device that can forge sideband<br /> reply messages on a physical connection.