CVE-2026-68255: drm/virtio: bound EDID block reads to the response buffer
In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: bound EDID block reads to the response buffer
virtiogetedidblock() validates the read offset only against the device-supplied resp->size field, never against the fixed-size resp->edid array. The EDID block index is driven by the device-supplied extension count, so a malicious virtio-gpu backend can advertise a large size together with a high block count and read far past the array into adjacent kernel memory, which is then surfaced in the parsed EDID (an out-of-bounds read / info leak).
Also reject any read whose end exceeds the size of the edid array. Conforming EDID responses stay within the array and are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure the virtio-gpu backend cannot influence the EDID response size/block count (e.g., restrict/validate the virtio-gpu backend configuration/inputs that supply EDID so a malicious backend cannot advertise an excessive resp->size or high block count).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68255?
CVE-2026-68255 has a risk score of 38.
How do I fix CVE-2026-68255?
To fix CVE-2026-68255, you should upgrade to the latest version of the Linux kernel that addresses this vulnerability.
What components are affected by CVE-2026-68255?
CVE-2026-68255 affects the Linux kernel, specifically the drm/virtio subsystem.
What type of vulnerability is CVE-2026-68255?
CVE-2026-68255 is categorized as a buffer overflow vulnerability.
Is CVE-2026-68255 exploitable in production environments?
Yes, CVE-2026-68255 can be exploited in production environments if the vulnerable version of the Linux kernel is used.