CVE-2026-68253: drm/i915/hdcp: check streams[] bounds before overflow
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/hdcp: check streams[] bounds before overflow
The data->streams[] overflow check is done after the buffer overflow has already happened. Move the overflow check before the write.
Side note, emitting a warning splat with a backtrace might be overkill here, but prefer not changing the behaviour other than not doing the overrun.
Discovered using AI-assisted static analysis confirmed by Intel Product Security.
(cherry picked from commit 9284ab3b6e776c315883ac2611283d263c9460fd)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68253?
CVE-2026-68253 has a risk score of 44, indicating a moderate severity level.
How do I fix CVE-2026-68253?
To fix CVE-2026-68253, update your Linux kernel to the version that includes the patch addressing the streams[] bounds check.
What is the impact of CVE-2026-68253?
The impact of CVE-2026-68253 can lead to a buffer overflow, potentially allowing an attacker to execute arbitrary code.
Is CVE-2026-68253 specific to a certain version of the Linux kernel?
Yes, CVE-2026-68253 affects specific versions of the Linux kernel that utilize the drm/i915/hdcp functionality.
Can CVE-2026-68253 be exploited remotely?
Exploitation of CVE-2026-68253 may require local access to the machine, as it involves kernel-level operations.