Skip to main content

Linux Kernel EUVDEUVD-2026-49036

| CVE-2026-64524 HIGH
2026-07-25 Linux GHSA-2rhv-cg46-xrx8
Denial Of Service Information Disclosure Linux
7.7
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.7 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
6.7 MEDIUM

AV:L for Hyper-V guest environment; AC:H because exploiting OOB read requires host-level VMBus message control; PR:N as no guest privileges needed; C:H for heap memory disclosure, A:H for display DoS.

3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

6
Metadata Corrected
Sep 16, 2026 - 09:40 vuln.today
tag: Denial Of Service added
Analysis Generated
Jul 27, 2026 - 06:05 vuln.today
CVSS changed
Jul 27, 2026 - 05:22 NVD
7.7 (HIGH)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 09:20 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 09:20 cve.org
HIGH 7.7

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/hyperv: validate resolution_count and fix WIN8 fallback

A SYNTHVID_RESOLUTION_RESPONSE with resolution_count > 64 walks past the supported_resolution[SYNTHVID_MAX_RESOLUTION_COUNT] array in the parse loop. Bound resolution_count against the array size, folded into the existing zero-check.

When the WIN10 resolution probe fails, the caller in hyperv_connect_vsp() left hv->screen_*_max / preferred_* unpopulated, which sets mode_config.max_width / max_height to 0 and makes drm_internal_framebuffer_create() reject every userspace framebuffer with -EINVAL. The pre-WIN10 branch had the same gap for preferred_width / preferred_height. Use a single post-probe fallback guarded by screen_width_max == 0 so both paths converge on the WIN8 defaults.

AnalysisAI

Out-of-bounds array read and missing initialization flaw in the Linux kernel's drm/hyperv virtual display driver affect Linux VMs running under Microsoft Hyper-V. A SYNTHVID_RESOLUTION_RESPONSE message carrying resolution_count exceeding 64 causes the guest kernel driver to walk past the end of the 64-entry supported_resolution[] array, potentially disclosing adjacent guest kernel heap memory to the Hyper-V host. A separate missing-initialization defect in the WIN10-to-WIN8 protocol fallback path leaves screen dimension fields at zero, causing drm_internal_framebuffer_create() to reject every userspace framebuffer with -EINVAL and effectively disabling virtual display. No public exploit exists and EPSS is 0.21%; exploitation of the OOB read requires host-level control over Hyper-V VMBus messaging.

Technical ContextAI

The drm/hyperv driver (drivers/gpu/drm/hyperv/) implements the Hyper-V Synthetic Video Protocol (SYNTHVID) to provide virtual GPU display capabilities to Linux guest VMs via the VMBus paravirtualization bus. During display resolution negotiation, the host sends a SYNTHVID_RESOLUTION_RESPONSE message containing a resolution_count field and an array of supported_resolution entries bounded by the compile-time constant SYNTHVID_MAX_RESOLUTION_COUNT (64). The parse loop lacked an upper-bound check on resolution_count, allowing a malicious or compromised host to trigger iteration past the end of the stack-allocated or struct-embedded array (CWE-125, Out-of-Bounds Read). Separately, hyperv_connect_vsp() failed to populate hv->screen_width_max, screen_height_max, preferred_width, and preferred_height when the WIN10 protocol probe failed, leaving them at zero; drm_mode_config.max_width and max_height were set to 0 as a consequence, causing all DRM framebuffer creation calls to return -EINVAL (CWE-665, Improper Initialization). CPE coverage is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*. The CWE field is listed as N/A in the source data, which is incorrect - both CWE-125 and CWE-665 apply.

RemediationAI

Update to a patched kernel version: 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, or 7.1. Upstream fix commits are available at git.kernel.org, including 96f7de3172d4aa878b7f87173b2b3507c350fcd6, bc573752f3dac0d1ab8df7078c1851bc76717653, 1fb565b77b8f44afabb02de6310065f109d89e94, a321c908f2eeea01539668eb270d074d9b88e490, 9c698b2c43c2667c34f5336bf46ad5786216ac2a, 8a114b25b5521eae451b13bce98ae978624962e5, and 13d33b9ef67066c77c84273fac5a1d3fde3533d1. Ubuntu users should apply the update via USN-8618-1 (https://ubuntu.com/security/notices/USN-8618-1). As a targeted compensating control, unloading or blacklisting the hyperv_drm module (echo 'blacklist hyperv_drm' >> /etc/modprobe.d/hyperv.conf) eliminates the OOB attack surface but also removes Hyper-V enhanced display support, falling back to the legacy hyperv_fb framebuffer driver; evaluate the operational impact before applying in production Hyper-V guest environments.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

EUVD-2026-49036 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy