{"id":"CVE-2026-68255","summary":"drm/virtio: bound EDID block reads to the response buffer","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: bound EDID block reads to the response buffer\n\nvirtio_get_edid_block() validates the read offset only against the\ndevice-supplied resp-\u003esize field, never against the fixed-size resp-\u003eedid\narray. The EDID block index is driven by the device-supplied extension\ncount, so a malicious virtio-gpu backend can advertise a large size\ntogether with a high block count and read far past the array into adjacent\nkernel memory, which is then surfaced in the parsed EDID (an out-of-bounds\nread / info leak).\n\nAlso reject any read whose end exceeds the size of the edid array.\nConforming EDID responses stay within the array and are unaffected.","modified":"2026-08-12T04:19:22.087417614Z","published":"2026-08-10T12:01:24.835Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68255.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/2757e6e803092cf0aeaf4b735e16b5d3bdc705c5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/35be0e2c6862abcd5e5f5445261f1fd910d4a9b4"},{"type":"WEB","url":"https://git.kernel.org/stable/c/375c1934ef0196d3b6d3a1eae3232bef8dae7bf7"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4e1a53892ba7f8a3e1da6bfc53c83ae7c812dccd"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9fc2a017c5d597937e0c28b9a9669844aa796c42"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68255.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68255"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"b4b01b4995fb15b55a2d067eb405917f5ab32709"},{"fixed":"9fc2a017c5d597937e0c28b9a9669844aa796c42"},{"fixed":"2757e6e803092cf0aeaf4b735e16b5d3bdc705c5"},{"fixed":"35be0e2c6862abcd5e5f5445261f1fd910d4a9b4"},{"fixed":"375c1934ef0196d3b6d3a1eae3232bef8dae7bf7"},{"fixed":"4e1a53892ba7f8a3e1da6bfc53c83ae7c812dccd"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68255.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"6.6.148"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.101"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.42"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68255.json"}}],"schema_version":"1.9.0"}