Skip to main content

Linux Kernel EUVDEUVD-2026-48617

| CVE-2026-64209 HIGH
Out-of-bounds Read (CWE-125)
2026-07-24 Linux GHSA-2j9g-74p9-mq3f
Buffer Overflow Information Disclosure Linux Red Hat Suse
7.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
7.1 HIGH

Local low-privilege access required to trigger the QMP PHY DP config path; OOB read exposes kernel memory (C:H) or causes a crash (A:H) with no write primitive and no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Aug 12, 2026 - 02:31 vuln.today
CVSS changed
Aug 12, 2026 - 00:22 NVD
7.1 (HIGH)
CVE Published
Jul 24, 2026 - 15:23 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 24, 2026 - 15:23 nvd
HIGH 7.1

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config

swing_tbl and pre_emphasis_tbl are 4x4 arrays (valid indices 0-3), but the boundary check uses "> 4" instead of ">= 4", allowing index 4 to cause an out-of-bounds access.

AnalysisAI

Out-of-bounds read in the Qualcomm QMP USB-C PHY driver (phy: qcom: qmp-usbc) of the Linux kernel allows a local low-privileged user to read kernel memory beyond the bounds of the swing_tbl and pre_emphasis_tbl DisplayPort signal-tuning arrays, risking kernel memory disclosure or a kernel panic. The root cause is an off-by-one error where the boundary guard uses > 4 instead of >= 4, permitting array index 4 on 4-element (0-3) rows. Exploitation is constrained to Qualcomm SoC hardware with USB-C DisplayPort capability; EPSS at 0.15% (5th percentile) and the absence of a KEV listing indicate no public exploit and very low current exploitation probability.

Technical ContextAI

The vulnerable code resides in the Linux kernel Qualcomm QMP (Multi-Protocol) USB-C PHY driver, which manages the electrical interface for DisplayPort-over-USB-C on Qualcomm Snapdragon SoC platforms. The driver uses two 4×4 arrays - swing_tbl and pre_emphasis_tbl - to store voltage swing and pre-emphasis tuning values for DisplayPort lane signaling. Due to an off-by-one flaw (> 4 rather than >= 4) in the index bounds check, the driver allows reading at index 4 of a 4-element (0-3) row, constituting a classic CWE-125 Out-of-bounds Read. This is not a write primitive, so direct code execution is not the primary concern; rather, the read may expose adjacent kernel memory contents or corrupt driver state leading to a crash. The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* applies, but the practical exposure is narrowed to systems physically equipped with Qualcomm QMP USB-C PHY silicon.

RemediationAI

Upgrade to Linux kernel 7.0.11 or 7.1, which contain the verified upstream fix commits cb35af6e7f3d5628178b58c631e305b1def8edf7 (https://git.kernel.org/stable/c/cb35af6e7f3d5628178b58c631e305b1def8edf7) and ea17fc4d7dc2ba6459b1a318962960520201baf1 (https://git.kernel.org/stable/c/ea17fc4d7dc2ba6459b1a318962960520201baf1), correcting the boundary check from > 4 to >= 4. Ubuntu users should apply the packages referenced in USN-8618-1 (https://ubuntu.com/security/notices/USN-8618-1). If an immediate kernel upgrade is not feasible, the phy-qcom-qmp-usbc kernel module can be blacklisted on systems where USB-C DisplayPort functionality is not required (echo 'blacklist phy-qcom-qmp-usbc' >> /etc/modprobe.d/blacklist.conf && update-initramfs -u), at the cost of disabling DisplayPort-over-USB-C on the affected hardware. Additionally, restricting local user account creation and enforcing least-privilege principles reduces the already-limited attack surface, since PR:L is required.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

EUVD-2026-48617 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy