CVE-2026-64546: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64546 Overview

CVE-2026-64546 is a heap out-of-bounds read vulnerability in the Linux kernel's Direct Rendering Manager (DRM) Extended Display Identification Data (EDID) parser. The flaw resides in drm_parse_tiled_block(), which casts a DisplayID block to a struct displayid_tiled_block and reads the fixed layout up to tile->topology_id[7] without validating block->num_bytes. A crafted EDID that advertises a tiled-display block with an undersized num_bytes at the end of a DisplayID extension causes the parser to read past the exact-sized kmemdup() allocation. The bug was detected by KASAN as a slab-out-of-bounds read in drm_edid_connector_update.

Critical Impact
A local attacker capable of supplying a malicious EDID to the kernel can trigger a heap out-of-bounds read, leading to kernel information disclosure or denial of service via KASAN-detected memory corruption.

Affected Products

Linux kernel builds containing the DRM EDID parser prior to the fix commits
Systems using the drm/edid subsystem for DisplayID tiled-display topology handling
Virtualized display drivers such as bochs that invoke drm_edid_connector_update

Discovery Timeline

2026-07-27 - CVE-2026-64546 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64546

Vulnerability Analysis

The vulnerability is an [Out-of-Bounds Read] in the Linux DRM EDID parsing path. drm_parse_tiled_block() treats an incoming DisplayID data block as a fixed-size struct displayid_tiled_block and reads through tile->topology_id[7], which corresponds to the specification's 22-byte tiled payload. The DisplayID iterator only validates the declared payload length rather than the actual required struct size for each tag. When a DisplayID extension contains a tiled block tagged DATA_BLOCK_TILED_DISPLAY or DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY with a num_bytes shorter than 22, the parser reads beyond the end of the exact-sized kmemdup()'d EDID buffer. KASAN reports the resulting slab-out-of-bounds read in drm_edid_connector_update, invoked via bochs_connector_helper_get_modes and drm_helper_probe_single_connector_modes when userspace writes to a connector status sysfs attribute.

Root Cause

The root cause is missing length validation. Unlike drm_parse_vesa_mso_data(), which rejects undersized blocks before dereferencing the fixed struct, drm_parse_tiled_block() proceeds directly to structured field access. The fix rejects any tiled block whose num_bytes is shorter than the specification-mandated 22-byte payload before reading the fixed struct fields.

Attack Vector

Exploitation requires local access with the ability to supply EDID data to the kernel. This can occur through writing to connector sysfs attributes such as status_store, loading a firmware EDID override, or attaching a malicious virtual or physical display. The crafted EDID includes a DisplayID extension whose tiled-display block declares a num_bytes value less than 22, triggering the read past the kmemdup() allocation boundary. The result is a heap out-of-bounds read that can leak adjacent slab data or crash the kernel.

No verified public exploit code is available. Technical details are documented in the upstream commits, including Kernel Git Commit 1 and Kernel Git Commit 3.

Detection Methods for CVE-2026-64546

Indicators of Compromise

KASAN reports containing slab-out-of-bounds in drm_edid_connector_update with a read of size 2 at a slab address
Kernel oops or panic traces referencing drm_parse_tiled_block or drm_edid_connector_update in the call stack
Unexpected writes to /sys/class/drm/*/status from unprivileged processes preceding DRM subsystem errors

Detection Strategies

Enable KASAN on test and pre-production kernels to detect the out-of-bounds read at runtime
Monitor kernel logs (dmesg, journalctl -k) for DRM parser stack traces involving drm_edid functions
Audit processes writing custom EDID overrides via /sys/kernel/debug/dri/*/edid_override or firmware EDID paths

Monitoring Recommendations

Ingest kernel logs into a centralized platform and alert on KASAN, BUG:, and slab-out-of-bounds strings
Track invocations of status_store on DRM connectors by non-root processes with process-level telemetry
Baseline hardware EDID contents on managed endpoints and flag deviations that include DisplayID extensions with unusual block lengths

How to Mitigate CVE-2026-64546

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits and rebuild affected kernels
Restrict write access to DRM connector sysfs attributes and EDID override interfaces to trusted administrators only
Prioritize patching multi-tenant hosts, virtualization hypervisors, and endpoints where untrusted users can trigger display probing

Patch Information

The fix rejects DisplayID tiled blocks shorter than the specification's 22-byte payload before reading the fixed struct, mirroring the length check already performed by drm_parse_vesa_mso_data(). The patch is available across stable branches through the following commits: Kernel Git Commit 1, Kernel Git Commit 2, Kernel Git Commit 3, Kernel Git Commit 4, Kernel Git Commit 5, Kernel Git Commit 6, Kernel Git Commit 7, and Kernel Git Commit 8.

Workarounds

Restrict permissions on /sys/class/drm/*/status and firmware EDID override paths to root-only access
Disable or unload DRM drivers on servers that do not require graphical output, such as headless virtualization hosts
Avoid allowing untrusted users to attach virtual displays or supply custom EDID binaries until patched kernels are deployed

bash

# Configuration example: restrict connector status writes and validate kernel version
sudo chmod 600 /sys/class/drm/card*/status
uname -r
dmesg | grep -Ei 'kasan|drm_parse_tiled_block|drm_edid_connector_update'