CVE-2026-97621: drm/rockchip: analogix_dp: fix unchecked bound endpoint name length
In the Linux kernel, the following vulnerability has been resolved:
drm/rockchip: analogixdp: fix unchecked bound endpoint name length
rockchipdpdrmencoderenable() uses sprintf() to format a device tree path into a 32-byte stack buffer. Device tree paths are not limited to this size, so a sufficiently long path can overflow the buffer.
Use snprintf() with the destination size to truncate the generated name and keep the writes within bounds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In rockchip_dp_drm_encoder_enable(), replace sprintf() when formatting the device tree endpoint name with snprintf() using the destination buffer size, so generated paths are truncated and writes remain within the 32-byte stack buffer.
Event History
Frequently Asked Questions
What configuration is required for this issue to be reachable?
The affected code is in the Rockchip Analogix DisplayPort driver and is reached when rockchip_dp_drm_encoder_enable() formats a device tree endpoint path. A device tree endpoint name/path long enough to exceed the 32-byte stack buffer is required to trigger the overflow.
Who can realistically exploit this?
An attacker would need a way to supply or alter the relevant device tree data so that the generated endpoint path is sufficiently long. The provided information does not establish exploitation through ordinary user-space DisplayPort use alone.
What can be done before applying the fix?
Ensure device tree endpoint names and resulting paths used by the Rockchip DisplayPort configuration remain within the 32-byte formatting buffer limit. Prevent untrusted parties from modifying or supplying device tree blobs.
How can I identify an affected build?
Inspect the Rockchip Analogix DisplayPort driver's rockchip_dp_drm_encoder_enable() implementation. Affected code uses sprintf() to write the device tree path into a 32-byte stack buffer; fixed code uses snprintf() with the destination buffer size.