CVE-2026-68279

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers<br /> <br /> drm_dp_sideband_parse_remote_dpcd_read() reads num_bytes from the raw<br /> message and then unconditionally does:<br /> <br /> memcpy(bytes, &amp;raw-&gt;msg[idx], num_bytes);<br /> <br /> without checking that idx + num_bytes curlen. raw-&gt;msg[] is<br /> 256 bytes; if a malicious or misbehaving MST hub sets num_bytes larger<br /> than the remaining payload, the memcpy reads past the received data<br /> into whatever follows in raw-&gt;msg[].<br /> <br /> drm_dp_sideband_parse_remote_i2c_read_ack() has the same flaw (noted<br /> with a /* TODO check */ comment since the code was introduced).<br /> <br /> Fix both functions by using a single combined check<br /> (idx + num_bytes &gt; curlen) before each memcpy. Since num_bytes is u8,<br /> it is always &gt;= 0, so this strictly subsumes the simpler idx &gt; curlen<br /> form and no separate step is needed.<br /> <br /> [added missing fixes tag]