CVE-2026-80749 (GCVE-0-2026-80749)

Vulnerability from cvelistv5 – Published: 2026-09-03 08:26 – Updated: 2026-09-04 04:58
VLAI
Title
drm/connector/hdmi: Fix out of bounds memory read
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/connector/hdmi: Fix out of bounds memory read A helper function was copying a given audio infoframe into the connector's copy but using the size of the destination (a generic target, sized to accept many different data blocks) not the source (a very specific type of data block). Thus, it was copying 60 bytes of data from a 28 byte allocation. Fix that by using the source size instead, together with a build bug on the source size actually being smaller than the destination. I hit this running KUnit tests under KASAN (while debugging something else entirely). In the real world, it seems unlikely to cause an actual problem. It is a read not a write so it can't corrupt any memory. However, it could potentially fall off the end of a page and cause an accvio bug.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f378b77227bc4732922c57f92be89438bb1018a1 , < d9f7454c185c0c7f0973e11d62ad6c06862c324c (git)
Affected: f378b77227bc4732922c57f92be89438bb1018a1 , < e5b527804a1ea4f70e139179d3062cf5de8c06ab (git)
Affected: f378b77227bc4732922c57f92be89438bb1018a1 , < f72bb95732bc5ca87b50c52c8f087ba501950809 (git)
Affected: f378b77227bc4732922c57f92be89438bb1018a1 , < 9ecf8ba763d0ffe0673538eb4bf7806f20455d19 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.12.105 , ≤ 6.12.* (semver)
Unaffected: 6.18.46 , ≤ 6.18.* (semver)
Unaffected: 7.1.10 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/display/drm_hdmi_state_helper.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d9f7454c185c0c7f0973e11d62ad6c06862c324c",
              "status": "affected",
              "version": "f378b77227bc4732922c57f92be89438bb1018a1",
              "versionType": "git"
            },
            {
              "lessThan": "e5b527804a1ea4f70e139179d3062cf5de8c06ab",
              "status": "affected",
              "version": "f378b77227bc4732922c57f92be89438bb1018a1",
              "versionType": "git"
            },
            {
              "lessThan": "f72bb95732bc5ca87b50c52c8f087ba501950809",
              "status": "affected",
              "version": "f378b77227bc4732922c57f92be89438bb1018a1",
              "versionType": "git"
            },
            {
              "lessThan": "9ecf8ba763d0ffe0673538eb4bf7806f20455d19",
              "status": "affected",
              "version": "f378b77227bc4732922c57f92be89438bb1018a1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/display/drm_hdmi_state_helper.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/connector/hdmi: Fix out of bounds memory read\n\nA helper function was copying a given audio infoframe into the\nconnector\u0027s copy but using the size of the destination (a generic\ntarget, sized to accept many different data blocks) not the source (a\nvery specific type of data block). Thus, it was copying 60 bytes of\ndata from a 28 byte allocation.\n\nFix that by using the source size instead, together with a build bug\non the source size actually being smaller than the destination.\n\nI hit this running KUnit tests under KASAN (while debugging something\nelse entirely). In the real world, it seems unlikely to cause an\nactual problem. It is a read not a write so it can\u0027t corrupt any\nmemory. However, it could potentially fall off the end of a page and\ncause an accvio bug."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via the ALSA PCM prepare path (SNDRV_PCM_IOCTL_PREPARE) through hdmi-codec into DRM HDMI audio prepare callbacks; it is not reachable from network protocols or remote packet handling.\nAC:L - Any local caller that can prepare HDMI audio reliably hits the faulty memcpy on every invocation; no special memory layout, timing window, or rare kernel configuration is required beyond having a supported HDMI audio driver loaded.\nPR:L - Triggering the path requires only access to ALSA PCM devices (/dev/snd/pcm*) to start HDMI audio playback, which typical unprivileged desktop, mobile, and embedded users already have without real root or init-namespace capabilities.\nUI:N - Exploitation is self-contained: the attacker prepares or starts HDMI audio playback themselves and does not depend on a separate victim performing an additional action beyond normal attacker-controlled playback setup.\nS:U - Impact is confined to kernel memory read and possible local kernel fault within the same privilege domain; it does not cross VM, IOMMU, or sandbox boundaries into another security authority.\nC:H - The vulnerable memcpy reads 60 bytes from a 28-byte hdmi_audio_infoframe, causing a 32-byte out-of-bounds kernel stack read whose contents are copied into connector state; OOB reads are rated High unless strictly limited to a few bytes.\nI:N - This is an out-of-bounds read, not an out-of-bounds write or use-after-free; kernel memory is not corrupted and no arbitrary write or control-flow hijack primitive is created, only mis-sized copying into an intended destination buffer.\nA:H - The over-read can cross a page boundary and fault (as noted by the fix author), producing a kernel oops/access violation; any kernel crash from memory access violations is rated High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T04:58:29.179Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d9f7454c185c0c7f0973e11d62ad6c06862c324c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5b527804a1ea4f70e139179d3062cf5de8c06ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/f72bb95732bc5ca87b50c52c8f087ba501950809"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ecf8ba763d0ffe0673538eb4bf7806f20455d19"
        }
      ],
      "title": "drm/connector/hdmi: Fix out of bounds memory read",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80749",
    "datePublished": "2026-09-03T08:26:30.140Z",
    "dateReserved": "2026-08-26T14:34:25.790Z",
    "dateUpdated": "2026-09-04T04:58:29.179Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80749",
      "date": "2026-09-21",
      "epss": "0.00159",
      "percentile": "0.05444"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/display/drm_hdmi_state_helper.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "d9f7454c185c0c7f0973e11d62ad6c06862c324c",
                    "status": "affected",
                    "version": "f378b77227bc4732922c57f92be89438bb1018a1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e5b527804a1ea4f70e139179d3062cf5de8c06ab",
                    "status": "affected",
                    "version": "f378b77227bc4732922c57f92be89438bb1018a1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f72bb95732bc5ca87b50c52c8f087ba501950809",
                    "status": "affected",
                    "version": "f378b77227bc4732922c57f92be89438bb1018a1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9ecf8ba763d0ffe0673538eb4bf7806f20455d19",
                    "status": "affected",
                    "version": "f378b77227bc4732922c57f92be89438bb1018a1",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/display/drm_hdmi_state_helper.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.11"
                  },
                  {
                    "lessThan": "6.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.105",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.46",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/connector/hdmi: Fix out of bounds memory read\n\nA helper function was copying a given audio infoframe into the\nconnector\u0027s copy but using the size of the destination (a generic\ntarget, sized to accept many different data blocks) not the source (a\nvery specific type of data block). Thus, it was copying 60 bytes of\ndata from a 28 byte allocation.\n\nFix that by using the source size instead, together with a build bug\non the source size actually being smaller than the destination.\n\nI hit this running KUnit tests under KASAN (while debugging something\nelse entirely). In the real world, it seems unlikely to cause an\nactual problem. It is a read not a write so it can\u0027t corrupt any\nmemory. However, it could potentially fall off the end of a page and\ncause an accvio bug."
          }
        ],
        "id": "CVE-2026-80749",
        "lastModified": "2026-09-04T05:17:14.877",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-03T13:06:14.520",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9ecf8ba763d0ffe0673538eb4bf7806f20455d19"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d9f7454c185c0c7f0973e11d62ad6c06862c324c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e5b527804a1ea4f70e139179d3062cf5de8c06ab"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f72bb95732bc5ca87b50c52c8f087ba501950809"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.