EUVD-2026-70353
GHSA-4qvv-f8j2-942j
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
OOB read is fixed-size (32 bytes) and heap-layout-dependent, justifying C:L; A:H retained for credible page-fault kernel crash.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
drm/connector/hdmi: Fix out of bounds memory read
A helper function was copying a given audio infoframe into the connector's copy but using the size of the destination (a generic target, sized to accept many different data blocks) not the source (a very specific type of data block). Thus, it was copying 60 bytes of data from a 28 byte allocation.
Fix that by using the source size instead, together with a build bug on the source size actually being smaller than the destination.
I hit this running KUnit tests under KASAN (while debugging something else entirely). In the real world, it seems unlikely to cause an actual problem. It is a read not a write so it can't corrupt any memory. However, it could potentially fall off the end of a page and cause an accvio bug.
AnalysisAI
Out-of-bounds memory read in the Linux kernel's DRM HDMI connector subsystem allows a local, low-privileged user to potentially leak up to 32 bytes of adjacent kernel heap memory or trigger a page fault leading to kernel crash. The flaw exists in a helper function that copies audio infoframe data using the destination buffer size (60 bytes) rather than the source structure size (28 bytes), reading 32 bytes beyond the source allocation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local, low-privilege access to a Linux system running a kernel between the introduction of f378b77227bc and the applicable fix commit. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is meaningfully lower than the 7.1 CVSS score suggests. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade to a patched Linux kernel version: 6.12.105, 6.18.46, 7.1.10, or mainline 7.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems running affected kernel versions using automated asset discovery and flag those with local user access or display hardware. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today