Skip to content
OpenAdvisories
High · 7.0 CVE-2026-64219 EUVD-2026-48627GHSA-gjfp-5cfr-xp55

drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async

Published Jul 24, 2026 · Updated Oct 19, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.15 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.4 Package: linux-aws-5.8 Package: linux-aws-6.14 Package: linux-aws-6.17 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-6.8 Package: linux-aws-fips Package: linux-aws-hwe Package: linux-azure Package: linux-azure-4.15 Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.15 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.4 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.14 Package: linux-azure-6.17 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-6.8 Package: linux-azure-7.0 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.15 Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.14 Package: linux-azure-fde-6.17 Package: linux-azure-fde-6.2 Package: linux-azure-fde-6.8 Package: linux-azure-fde-7.0 Package: linux-azure-fips Package: linux-azure-nvidia Package: linux-azure-nvidia-6.14 Package: linux-bluefield Package: linux-fips Package: linux-gcp Package: linux-gcp-4.15 Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.15 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.4 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.14 Package: linux-gcp-6.17 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-6.8 Package: linux-gcp-7.0 Package: linux-gcp-fips Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.15 Package: linux-hwe-5.19 Package: linux-hwe-5.4 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.14 Package: linux-hwe-6.17 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-6.8 Package: linux-hwe-7.0 Package: linux-hwe-edge Package: linux-ibm Package: linux-ibm-5.15 Package: linux-ibm-5.4 Package: linux-ibm-6.8 Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-intel-iotg Package: linux-intel-iotg-5.15 Package: linux-iot Package: linux-kvm Package: linux-lowlatency Package: linux-lowlatency-hwe-5.15 Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-lowlatency-hwe-6.8 Package: linux-lts-xenial Package: linux-nvidia Package: linux-nvidia-6.11 Package: linux-nvidia-6.17 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-nvidia-6.8 Package: linux-nvidia-7.0 Package: linux-nvidia-bos Package: linux-nvidia-lowlatency Package: linux-nvidia-tegra Package: linux-nvidia-tegra-5.15 Package: linux-nvidia-tegra-igx Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.14 Package: linux-oem-6.17 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oem-7.0 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.15 Package: linux-oracle-5.3 Package: linux-oracle-5.4 Package: linux-oracle-5.8 Package: linux-oracle-6.14 Package: linux-oracle-6.17 Package: linux-oracle-6.5 Package: linux-oracle-6.8 Package: linux-oracle-7.0 Package: linux-raspi Package: linux-raspi-5.4 Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-realtime-6.14 Package: linux-realtime-6.17 Package: linux-realtime-6.8 Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.15 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.14 Package: linux-riscv-6.17 Package: linux-riscv-6.5 Package: linux-riscv-6.8 Package: linux-riscv-7.0 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Package: linux-xilinx Package: linux-xilinx-zynqmp Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async

[Why&How]
dc_process_dmub_aux_transfer_async() copies payload->length bytes into a
16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(), which
is a no-op in release builds. If a caller ever passes length > 16 this
results in a stack buffer overflow via memcpy.

Additionally, link_index is used to dereference dc->links[] without
bounds checking against dc->link_count, risking an out-of-bounds access.

Replace the ASSERT with a hard runtime check that returns false when
payload->length exceeds the destination buffer size, and add a bounds
check for link_index before it is used.

(cherry picked from commit ba4caa9fecdf7a38f98c878ad05a8a64148b6881)

Affected products

VendorProductAffectedFixed
Linux Linux 5.13 5.15.209

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 7.0.12-1 —
Debian 13 linux 6.12.94-1 —
Debian 12 linux 6.1.176-1 —
ReleasePackageFixed inAdvisory
Ubuntu Nvidia-BlueField 24.04 LTS linux-bluefield 6.8.0-1030.35 —
Ubuntu Nvidia-BlueField 22.04 LTS linux-bluefield 5.15.0-1096.98 —
Ubuntu 26.04 LTS linux 7.0.0-28.28 —
Ubuntu 26.04 LTS linux-aws +2 7.0.0-1009.9 USN-8618-1
Ubuntu 26.04 LTS linux-gcp +1 7.0.0-1008.8 —
Ubuntu 26.04 LTS linux-gke 7.0.0-1003.4 —
Ubuntu 26.04 LTS linux-ibm +1 7.0.0-1010.10 —
Ubuntu 26.04 LTS linux-nvidia 7.0.0-1016.16 USN-8663-1
Ubuntu 26.04 LTS linux-nvidia-bos 7.0.0-2016.16 USN-8664-1
Ubuntu 26.04 LTS linux-raspi 7.0.0-1015.15 USN-8618-1
Ubuntu 26.04 LTS linux-riscv +1 7.0.0-28.28.1 —
Ubuntu 24.04 LTS linux 6.8.0-139.139 USN-8729-1
Ubuntu 24.04 LTS linux-aws 6.8.0-1064.67 USN-8729-6
Ubuntu 24.04 LTS linux-azure-7.0 7.0.0-1014.14~24.04.1 USN-8728-2
Ubuntu 24.04 LTS linux-azure-fde 6.8.0-1065.72 —
Ubuntu 24.04 LTS linux-azure-fde-7.0 7.0.0-1013.13~24.04.1 —
Ubuntu 24.04 LTS linux-gcp +1 6.8.0-1067.75 USN-8761-1, USN-8729-1
Ubuntu 24.04 LTS linux-gcp-7.0 +1 7.0.0-1011.11~24.04.1 USN-8728-3, USN-8728-1
Ubuntu 24.04 LTS linux-gke 6.8.0-1062.70 USN-8729-1
Ubuntu 24.04 LTS linux-gkeop 6.8.0-1049.53 USN-8729-1
Ubuntu 24.04 LTS linux-hwe-7.0 7.0.0-28.28~24.04.1 —
Ubuntu 24.04 LTS linux-ibm 6.8.0-1064.65 USN-8729-3
Ubuntu 24.04 LTS linux-lowlatency 6.8.0-139.139.1 USN-8729-4
Ubuntu 24.04 LTS linux-nvidia 6.8.0-1062.65 USN-8729-1
Ubuntu 24.04 LTS linux-nvidia-7.0 7.0.0-1016.16~24.04.1 USN-8663-1
Ubuntu 24.04 LTS linux-nvidia-lowlatency 6.8.0-1062.65.1 USN-8729-1
Ubuntu 24.04 LTS linux-nvidia-tegra 6.8.0-1035.38 USN-8781-1
Ubuntu 24.04 LTS linux-oracle 6.8.0-1061.64 USN-8802-1
Ubuntu 24.04 LTS linux-raspi 6.8.0-1064.68 USN-8729-1
Ubuntu 24.04 LTS linux-riscv +28 No fix yet —
Ubuntu 24.04 LTS linux-riscv-7.0 7.0.0-28.28.1~24.04.3 —
Ubuntu 24.04 LTS linux-vmware 6.8.0-1008.8 —
Ubuntu 24.04 LTS linux-xilinx 6.8.0-1036.37 USN-8729-3
Ubuntu 22.04 LTS linux 5.15.0-186.196 —
Ubuntu 22.04 LTS linux-aws 5.15.0-1112.119 —
Ubuntu 22.04 LTS linux-aws-6.8 6.8.0-1064.67~22.04.1 USN-8729-6
Ubuntu 22.04 LTS linux-azure +1 5.15.0-1117.126 —
Ubuntu 22.04 LTS linux-azure-fde-6.8 6.8.0-1065.72~22.04.1 —
Ubuntu 22.04 LTS linux-gcp 5.15.0-1112.122 —
Ubuntu 22.04 LTS linux-gcp-6.8 +1 6.8.0-1067.75~22.04.1 USN-8761-3, USN-8729-3
Ubuntu 22.04 LTS linux-gke 5.15.0-1108.114 —
Ubuntu 22.04 LTS linux-gkeop 5.15.0-1095.103 —
Ubuntu 22.04 LTS linux-hwe-6.8 6.8.0-149.149~22.04.1 USN-9066-1
Ubuntu 22.04 LTS linux-ibm 5.15.0-1106.110 —
Ubuntu 22.04 LTS linux-ibm-6.8 6.8.0-1066.67~22.04.1 USN-8906-1
Ubuntu 22.04 LTS linux-intel-iotg 5.15.0-1107.113 USN-8620-4
Ubuntu 22.04 LTS linux-kvm 5.15.0-1104.109 —
Ubuntu 22.04 LTS linux-lowlatency 5.15.0-184.194 —
Ubuntu 22.04 LTS linux-lowlatency-hwe-6.8 6.8.0-139.139.1~22.04.1 USN-8729-4
Ubuntu 22.04 LTS linux-nvidia 5.15.0-1107.108 —
Ubuntu 22.04 LTS linux-nvidia-6.8 6.8.0-1062.65~22.04.1 USN-8729-1
Ubuntu 22.04 LTS linux-nvidia-tegra 5.15.0-1064.66 —
Ubuntu 22.04 LTS linux-nvidia-tegra-igx 5.15.0-1053.53 —
Ubuntu 22.04 LTS linux-oracle 5.15.0-1109.115 —
Ubuntu 22.04 LTS linux-oracle-6.8 6.8.0-1061.64~22.04.1 USN-8802-1
Ubuntu 22.04 LTS linux-raspi 5.15.0-1106.109 USN-8668-2
Ubuntu 22.04 LTS linux-riscv +32 No fix yet —
Ubuntu 22.04 LTS linux-riscv-6.8 6.8.0-139.139~22.04.1 —
Ubuntu 22.04 LTS linux-xilinx-zynqmp 5.15.0-1075.79 —
Show 9 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Ubuntu Pro Realtime 24.04 LTS linux-raspi-realtime 6.8.0-2053.55 USN-8729-2
Ubuntu Pro Realtime 24.04 LTS linux-realtime 6.8.1-1059.60 USN-8729-1
Ubuntu Pro Realtime 24.04 LTS linux-realtime-6.14 +1 No fix yet —
Ubuntu Pro Realtime 22.04 LTS linux-intel-iot-realtime 5.15.0-1104.106 USN-8620-3
Ubuntu Pro Realtime 22.04 LTS linux-realtime 5.15.0-1111.120 —
Ubuntu Pro Realtime 22.04 LTS linux-realtime-6.8 6.8.1-1059.60~22.04.1 USN-8729-1
Ubuntu Pro FIPS-updates 24.04 LTS linux-aws-fips 6.8.0-1064.67+fips1 USN-8729-5
Ubuntu Pro FIPS-updates 24.04 LTS linux-fips 6.8.0-139.139+fips1 USN-8729-1
Ubuntu Pro FIPS-updates 24.04 LTS linux-gcp-fips +1 6.8.0-1067.75+fips1 USN-8761-2, USN-8729-1
Ubuntu Pro FIPS-updates 22.04 LTS linux-aws-fips 5.15.0-1112.119+fips1 —
Ubuntu Pro FIPS-updates 22.04 LTS linux-azure-fips 5.15.0-1117.126+fips1 USN-8620-2
Ubuntu Pro FIPS-updates 22.04 LTS linux-fips 5.15.0-186.196+fips1 —
Ubuntu Pro FIPS-updates 22.04 LTS linux-gcp-fips 5.15.0-1112.122+fips1 —
Ubuntu Pro FIPS-preview 22.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro 20.04 LTS linux-aws-5.15 5.15.0-1112.119~20.04.1 —
Ubuntu Pro 20.04 LTS linux-azure-5.15 5.15.0-1117.126~20.04.1 USN-8620-1
Ubuntu Pro 20.04 LTS linux-azure-fde-5.15 5.15.0-1117.126~20.04.2 USN-8620-1
Ubuntu Pro 20.04 LTS linux-gcp-5.15 5.15.0-1112.122~20.04.1 USN-8668-1
Ubuntu Pro 20.04 LTS linux-hwe-5.15 5.15.0-186.196~20.04.1 —
Ubuntu Pro 20.04 LTS linux-ibm-5.15 +1 5.15.0-1106.110~20.04.1 —
Ubuntu Pro 20.04 LTS linux-intel-iotg-5.15 5.15.0-1107.113~20.04.1 USN-8620-3
Ubuntu Pro 20.04 LTS linux-lowlatency-hwe-5.15 5.15.0-184.194~20.04.1 —
Ubuntu Pro 20.04 LTS linux-nvidia-tegra-5.15 5.15.0-1064.66~20.04.1 —
Ubuntu Pro 20.04 LTS linux-oracle-5.15 5.15.0-1109.115~20.04.1 USN-8620-1
ReleasePackageFixed inAdvisory
RHEL 10 rv +76 6.12.0-211.49.1.el10_2 RHSA-2026:57251
RHEL 9 rv +75 5.14.0-687.41.1.el9_8 RHSA-2026:57252
RHEL 8 kernel-rt +12 4.18.0-553.156.1.rt7.497.el8_10 RHSA-2026:55765
RHEL 8 perf +26 4.18.0-553.156.1.el8_10 RHSA-2026:55764
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.6 EUS rv +77 5.14.0-570.155.1.el9_6 RHSA-2026:98239

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 rv +74 6.12.0-211.49.1.el10_2 ALSA-2026:57251
AlmaLinux 9 rv +73 5.14.0-687.41.1.el9_8 ALSA-2026:57252
AlmaLinux 8 kernel-rt +9 4.18.0-553.156.1.rt7.497.el8_10 ALSA-2026:55765
AlmaLinux 8 perf +24 4.18.0-553.156.1.el8_10 ALSA-2026:55764

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 kernel 6.12.0-211.49.1.el10_2 RLSA-2026:57251
Rocky Linux 9 kernel 5.14.0-687.41.1.el9_8 RLSA-2026:57252
Rocky Linux 8 kernel 4.18.0-553.156.1.el8_10 RLSA-2026:55764
Rocky Linux 8 kernel-rt 4.18.0-553.156.1.rt7.497.el8_10 RLSA-2026:55765
ReleasePackageFixed inAdvisory
SLES 15 SP7 kernel-64kb +7 6.4.0-150700.53.81.1 SUSE-SU-2026:4254-1
SLES 15 SP7 kernel-default-base 6.4.0-150700.53.81.1.150700.17.45.1 SUSE-SU-2026:4254-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 kernel-64kb +8 6.12.0-160000.38.1 SUSE-SU-2026:23902-1
SLES for SAP 16.0 kernel-default-base 6.12.0-160000.38.1.160000.2.23 SUSE-SU-2026:23902-1
SLES 16.0 kernel-64kb +8 6.12.0-160000.38.1 SUSE-SU-2026:23902-1, SUSE-SU-2026:23897-1
SLES 16.0 kernel-default-base 6.12.0-160000.38.1.160000.2.23 SUSE-SU-2026:23902-1
SLE Micro 6.2 kernel-default-base 6.12.0-160000.38.1.160000.2.23 SUSE-SU-2026:23887-1
SLE Micro 6.2 kernel-rt +5 6.12.0-160000.38.1 SUSE-SU-2026:23887-1, SUSE-SU-2026:23881-1
SLE Micro 6.1 kernel-default-base 6.4.0-52.1.21.34 SUSE-SU-2026:23529-1
SLE Micro 6.1 kernel-rt +4 6.4.0-52.1 SUSE-SU-2026:23529-1, SUSE-SU-2026:23528-1
SLE Micro 6.0 kernel-default-base 6.4.0-52.1.21.36 SUSE-SU-2026:23481-1
SLE Micro 6.0 kernel-rt +4 6.4.0-52.1 SUSE-SU-2026:23481-1, SUSE-SU-2026:23477-1
SLE Live Patching 15 SP7 kernel-default 6.4.0-150700.53.81.1 SUSE-SU-2026:4254-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7-RT_Update_20 1-150700.1.3.1 SUSE-SU-2026:4120-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_21 1-150700.15.3.1 SUSE-SU-2026:4254-1
SUSE Real Time Module 15 SP7 kernel-rt +2 6.4.0-150700.7.75.1 SUSE-SU-2026:4120-1
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 kernel-default-base 6.12.0-160000.38.1.160000.2.22 openSUSE-SU-2026:21910-1
openSUSE Leap 16.0 kernel-rt +11 6.12.0-160000.38.1 openSUSE-SU-2026:21910-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 rv +29 6.12.0-211.49.1.el10_2 ELSA-2026-57251
Oracle Linux 9 rv +28 5.14.0-687.41.1.el9_8 ELSA-2026-57252
Oracle Linux 8 perf +19 4.18.0-553.156.1.el8_10 ELSA-2026-55764

Advisories 50

References