CVE-2026-45958: drm/exynos: vidi: fix to avoid directly dereferencing user pointer
In the Linux kernel, the following vulnerability has been resolved:
drm/exynos: vidi: fix to avoid directly dereferencing user pointer
In vidiconnectionioctl(), vidi->edid(user pointer) is directly dereferenced in the kernel.
This allows arbitrary kernel memory access from the user space, so instead of directly accessing the user pointer in the kernel, we should modify it to copy edid to kernel memory using copyfromuser() and use it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify vidi_connection_ioctl() so that the edi(d) user pointer (vidi->edid) is copied into kernel memory using copy_from_user(), and do not directly dereference the user pointer in the kernel; then use the copied kernel buffer for subsequent logic.
Linux kernel DRM/exynos vidi driver (vidi_connection_ioctl) Use copy_from_user() instead of direct dereference of the user pointer (vidi->edid) = copy_from_user()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45958?
CVE-2026-45958 has a severity score of 7.8, classified as high.
What vulnerabilities does CVE-2026-45958 address?
CVE-2026-45958 addresses the direct dereferencing of a user pointer in the Linux kernel's vidi_connection_ioctl function.
How does CVE-2026-45958 affect system security?
CVE-2026-45958 allows arbitrary kernel memory access from user space, potentially compromising system security.
How do I fix CVE-2026-45958?
To fix CVE-2026-45958, ensure that you apply the latest Linux kernel patches that include the appropriate remediation.
Which software versions are vulnerable to CVE-2026-45958?
CVE-2026-45958 affects versions of the Linux kernel that use the drm/exynos module, including Microsoft azl3 kernel 6.6.139.1-1.