CVE-2026-68255: Linux Kernel Information Disclosure Flaw

CVE-2026-68255 Overview

CVE-2026-68255 is an out-of-bounds read vulnerability in the Linux kernel's drm/virtio driver. The flaw resides in virtio_get_edid_block(), which validates the read offset only against the device-supplied resp->size field and never against the fixed-size resp->edid array. A malicious virtio-gpu backend can advertise an inflated size along with a high extension block count, causing the driver to read past the array into adjacent kernel memory. The leaked data is surfaced in the parsed Extended Display Identification Data (EDID), producing a kernel information leak.

Critical Impact
A compromised or malicious virtio-gpu backend can trigger an out-of-bounds read in the guest kernel, exposing adjacent kernel memory and potentially causing availability impact.

Affected Products

Linux kernel with the drm/virtio (virtio-gpu) driver enabled
Guest virtual machines using paravirtualized virtio-gpu displays
Distributions shipping vulnerable kernel versions prior to the referenced stable commits

Discovery Timeline

2026-08-10 - CVE-2026-68255 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68255

Vulnerability Analysis

The Linux kernel's virtio-gpu driver retrieves EDID data from the hypervisor-provided backend in fixed-size blocks. The virtio_get_edid_block() function copies EDID bytes from resp->edid, a fixed-size array in the response structure. Before copying, the function checks only whether the requested offset fits within resp->size, a value supplied by the device. It does not verify that the offset and length fall within the actual bounds of the resp->edid array.

The block index passed to this function is derived from the device-supplied EDID extension count. Because both the size and extension count originate from an untrusted backend, a malicious or compromised virtio-gpu device can craft a response that drives reads far beyond the array boundary. Data read from adjacent kernel memory is then incorporated into the parsed EDID structure and can be surfaced to userspace consumers of display information.

Root Cause

The root cause is missing bounds validation against the fixed-size destination array [CWE-125]. The function trusts the device-supplied resp->size value as an authoritative bound, but this value is attacker-controlled. The fix rejects any read whose end offset exceeds the size of the edid array, so conforming EDID responses remain unaffected while malformed responses are refused.

Attack Vector

Exploitation requires local access to a guest that uses a virtio-gpu device backed by a malicious or compromised hypervisor-side implementation. An attacker controlling the backend advertises an oversized resp->size together with a high extension block count. When the guest kernel processes the EDID response, it performs out-of-bounds reads into kernel memory adjacent to the response buffer. The leaked contents can include sensitive kernel data structures useful for subsequent exploitation or kernel address disclosure.

The vulnerability is described in prose because verified proof-of-concept code is not publicly available. See the Linux Kernel Git Commit Fix and the Linux Kernel Git Commit Patch for the authoritative patch series.

Detection Methods for CVE-2026-68255

Indicators of Compromise

Unexpected or malformed EDID data reported by guest display utilities such as edid-decode or xrandr --props.
Kernel log entries from the drm/virtio subsystem referencing unusually large EDID sizes or extension counts.
Guest kernels running on hypervisors where the virtio-gpu backend is untrusted, third-party, or recently modified.

Detection Strategies

Inventory running kernel versions across Linux hosts and virtual machines, and flag any that predate the stable kernel commits referenced in the advisory.
Audit virtualization hosts for use of the virtio-gpu device and identify guests that rely on hypervisor-supplied EDID.
Correlate guest telemetry with hypervisor logs to identify anomalous virtio-gpu command sequences that request excessive EDID blocks.

Monitoring Recommendations

Ingest guest kernel logs into a centralized data lake and alert on drm or virtio_gpu warnings involving EDID parsing.
Monitor for privilege escalation attempts or unexpected kernel address leaks that follow anomalous display device activity.
Track the deployment status of stable kernel updates across the fleet to confirm patch coverage.

How to Mitigate CVE-2026-68255

Immediate Actions Required

Apply the upstream Linux kernel patches from the referenced stable trees and rebuild or update kernel packages provided by the distribution.
Reboot affected guests after patch installation so the updated drm/virtio driver is loaded.
Restrict use of untrusted or third-party virtio-gpu backends until affected guests are patched.

Patch Information

The fix bounds EDID block reads against the size of the fixed resp->edid array and rejects any read whose end exceeds the array. Patches are available in the following commits: 2757e6e8, 35be0e2c, 375c1934, 4e1a5389, and 9fc2a017.

Workarounds

Disable the virtio-gpu device in guest configurations that do not require paravirtualized graphics, and use an alternate display device.
Unload or blacklist the virtio_gpu kernel module on guests where it is not needed.
Ensure the hypervisor and virtio-gpu backend originate from trusted sources and are kept current with vendor updates.

bash

# Blacklist the virtio_gpu module on affected guests until patching is complete
echo 'blacklist virtio_gpu' | sudo tee /etc/modprobe.d/blacklist-virtio-gpu.conf
sudo update-initramfs -u
# Verify the module is not loaded after reboot
lsmod | grep virtio_gpu