{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:12.940Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ca400d8e0c1c9d79c08dfb6b7f966e26c8cae7fb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/46806e59a87790760870d216f54951a5b4d545bc"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26699",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:52:47.122143Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:29.383Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ca400d8e0c1c9d79c08dfb6b7f966e26c8cae7fb",
              "status": "affected",
              "version": "8774029f76b9806f2f3586bb0502408076767fd5",
              "versionType": "git"
            },
            {
              "lessThan": "46806e59a87790760870d216f54951a5b4d545bc",
              "status": "affected",
              "version": "8774029f76b9806f2f3586bb0502408076767fd5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.6",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix array-index-out-of-bounds in dcn35_clkmgr\n\n[Why]\nThere is a potential memory access violation while\niterating through array of dcn35 clks.\n\n[How]\nLimit iteration per array size."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is in the amdgpu DC clock-manager initialization path (`dcn35_clk_mgr_construct`), reached only via local driver init/probe on a DCN35 APU; there is no network, adjacent-network, or removable-device path to it. Local system access to the GPU device is what is needed, so Local is the correct and highest defensible vector.\nAC:L - There is no race and no dependency on unpredictable memory layout \u2014 on an affected DCN35 system whose PMFW reports level counts above the driver\u0027s array sizes, the unbounded loops overflow deterministically on every driver initialization. Per the higher-severity rule this is Low rather than High.\nPR:L - The overflow executes in the driver-init path with no credential or capability check of its own, and requires only local access to the amdgpu device rather than verified root in the initial namespace. This matches the established scoring for amdgpu display driver bugs in this subsystem.\nUI:N - The vulnerable helper runs unconditionally during display-core construction (`pstate_enabled` defaults to true for DCN35) with no victim action such as opening a file or plugging in a device. No user interaction is involved.\nS:U - The out-of-bounds read and write both stay within the kernel\u0027s own memory and the driver\u0027s DMA buffer, corrupting kernel data structures managed by the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - `MemPstateTable[]`, `FclkClocks_Freq[]`, `DcfClocks[]` and `SocClocks[]` are read far past their bounds \u2014 up to ~4 KB beyond the single-page VRAM buffer \u2014 and the resulting adjacent memory contents are propagated into `bw_params-\u003eclk_table.entries[]`, which is surfaced through DC logging and clock reporting. This is an unbounded OOB read leveraged for information disclosure.\nI:H - `bw_params-\u003eclk_table.entries[i]` is written for `i` bounded only by an attacker/firmware-supplied `uint8_t`, against an 8-element array, giving an out-of-bounds write of up to ~10 KB of partly firmware-controlled data past the static `dcn35_bw_params` global into adjacent kernel `.data`. Such adjacent-global corruption is exploitable for control-flow or state manipulation.\nA:H - The OOB read walks off the end of the one-page VRAM BO mapping and the OOB write smashes neighbouring kernel globals, producing oops/panic or a corrupted display clock state at boot. Any kernel crash of this kind is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:26:46.401Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ca400d8e0c1c9d79c08dfb6b7f966e26c8cae7fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/46806e59a87790760870d216f54951a5b4d545bc"
        }
      ],
      "title": "drm/amd/display: Fix array-index-out-of-bounds in dcn35_clkmgr",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26699",
    "datePublished": "2024-04-03T14:54:59.268Z",
    "dateReserved": "2024-02-19T14:20:24.157Z",
    "dateUpdated": "2026-08-05T11:26:46.401Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}