Linux Kernel EUVD-2026-55356

The vulnerability exists in virtio_get_edid_block() within the Linux kernel's DRM (Direct Rendering Manager) virtio-gpu paravirtualized display driver. EDID (Extended Display Identification Data) is a binary metadata format through which displays advertise their capabilities; in virtualized guests, this data is fetched from the hypervisor-controlled virtio-gpu backend via a shared-memory response buffer. The function validates the read offset against the device-supplied resp->size field - a value entirely under backend control - but never against the actual fixed-size bounds of the resp->edid array. The EDID extension block count, also backend-supplied, drives the block index loop. A crafted response with inflated size and a high extension count causes the kernel to iterate past the array boundary into adjacent kernel memory, returning that data as part of the parsed EDID. The CPE (cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*) spans all Linux versions from 5.0 onward. No formal CWE is assigned, but the root cause is a classic missing bounds check against the actual buffer size - logically CWE-125 (Out-of-bounds Read) - exacerbated by trusting device-supplied length fields without independent verification.