CVE-2026-45958 Overview
CVE-2026-45958 is a Linux kernel vulnerability in the drm/exynos Virtual Display (VIDI) driver. The flaw resides in the vidi_connection_ioctl() function, which directly dereferences a user-supplied pointer (vidi->edid) inside kernel context. Because the kernel trusts the address provided from user space, an unprivileged caller can read or influence arbitrary kernel memory through the ioctl interface. Maintainers resolved the issue by copying the Extended Display Identification Data (EDID) buffer into kernel memory with copy_from_user() before use.
Critical Impact
A local user with access to the Exynos DRM device can trigger arbitrary kernel memory access, leading to information disclosure or kernel memory corruption.
Affected Products
- Linux kernel containing the drm/exynos VIDI driver
- Distributions shipping affected stable kernels referenced in upstream commits
- Embedded and ARM-based systems using Exynos DRM
Discovery Timeline
- 2026-05-27 - CVE-2026-45958 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45958
Vulnerability Analysis
The drm/exynos Virtual Display (VIDI) driver exposes an ioctl handler, vidi_connection_ioctl(), used to manage virtual display connection events including EDID data. In the affected code path, the kernel reads from vidi->edid, a pointer value supplied directly by user space, without first copying the data into a kernel buffer. Operating on a raw user pointer inside kernel mode breaks the user/kernel address space boundary that Linux memory protections depend on.
Because the dereferenced address is attacker-controlled, the operation can target arbitrary kernel virtual addresses. Depending on how the EDID data is consumed downstream, this enables read primitives against kernel memory and may permit influence over kernel data structures. The patch replaces the direct dereference with a copy_from_user() call that validates the source region and stages the EDID buffer in kernel memory before any further processing.
Root Cause
The root cause is improper handling of a user-space pointer in kernel context. The ioctl handler treated vidi->edid as if it referenced kernel-accessible memory, omitting the required copy_from_user() boundary transition. This pattern violates standard Linux kernel input-handling discipline for ioctl payloads.
Attack Vector
Exploitation requires local access to the Exynos DRM device node and the ability to issue ioctl calls against the VIDI driver. An attacker constructs an ioctl request with a crafted edid pointer aimed at a target kernel address. When the handler dereferences the pointer, the kernel operates on memory the attacker selected, enabling information disclosure or corruption of kernel state.
No verified public exploit code is referenced in the advisory. Technical context is available in the upstream stable tree commits, including Linux Kernel Commit 13537f7 and Linux Kernel Commit 2e147aa.
Detection Methods for CVE-2026-45958
Indicators of Compromise
- Unexpected ioctl activity from unprivileged processes against /dev/dri/* nodes on Exynos platforms
- Kernel oops, general protection faults, or BUG: messages referencing vidi_connection_ioctl in dmesg
- Processes opening DRM device nodes that have no display or graphics-related role
Detection Strategies
- Audit kernel logs for crashes or warnings originating in the drm/exynos VIDI code path
- Monitor for unsigned or out-of-policy kernel modules loaded on Exynos-based devices
- Compare running kernel versions against the fixed commits listed in the upstream stable tree references
Monitoring Recommendations
- Enable kernel auditing of ioctl calls targeting DRM device files on affected systems
- Forward dmesg and auditd events to a centralized logging or SIEM platform for correlation
- Track local privilege escalation attempts and unexpected process behavior on ARM/Exynos endpoints
How to Mitigate CVE-2026-45958
Immediate Actions Required
- Update affected Linux kernels to a stable release that includes the upstream fix referenced in the NVD advisory
- Restrict access to DRM device nodes (/dev/dri/*) to trusted users and graphics-related service accounts
- Inventory Exynos-based systems and prioritize patching for those exposing the VIDI driver
Patch Information
The fix replaces the direct user pointer dereference in vidi_connection_ioctl() with a copy_from_user() operation that safely stages EDID data in kernel memory. Patched commits are published across stable branches, including Linux Kernel Commit 235d702, Linux Kernel Commit 4949e32, Linux Kernel Commit 4c41938, Linux Kernel Commit 7efb6a4, Linux Kernel Commit c2914c0, and Linux Kernel Commit d4c98c0. Apply the version provided by your distribution vendor.
Workarounds
- Unload or blacklist the exynos_drm module on systems that do not require the virtual display driver
- Tighten permissions on /dev/dri/* so that only authorized users can open the device
- Apply Linux Security Module policies (SELinux, AppArmor) to limit ioctl access to DRM devices
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
