{"id":"CVE-2026-68255","revision":"be5cbf357c5b4176b6aeed8b5270a580","records":[{"revision":"be5cbf357c5b4176b6aeed8b5270a580","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-68255","aliases":[],"title":"drm/virtio: bound EDID block reads to the response buffer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: bound EDID block reads to the response buffer\n\nvirtio_get_edid_block() validates the read offset only against the\ndevice-supplied resp->size field, never against the fixed-size resp->edid\narray. The EDID block index is driven by the device-supplied extension\ncount, so a malicious virtio-gpu backend can advertise a large size\ntogether with a high block count and read far past the array into adjacent\nkernel memory, which is then surfaced in the parsed EDID (an out-of-bounds\nread / info leak).\n\nAlso reject any read whose end exceeds the size of the edid array.\nConforming EDID responses stay within the array and are unaffected.","state":0,"publishedAt":"2026-08-10T12:01:24.835+00:00","modifiedAt":"2026-10-19T20:58:58.229+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/virtio/virtgpu_vq.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"b4b01b4995fb15b55a2d067eb405917f5ab32709\",\n                            \"lessThan\": \"65ce911f341ad8ff0c08922eff5bb6db75666eb0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b4b01b4995fb15b55a2d067eb405917f5ab32709\",\n                            \"lessThan\": \"64bedd2758eccbc74d39f7006a7ec16fa39dc901\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b4b01b4995fb15b55a2d067eb405917f5ab32709\",\n                            \"lessThan\": \"3f506a85a905b080cadc029a1651a310479090a6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b4b01b4995fb15b55a2d067eb405917f5ab32709\",\n                            \"lessThan\": \"9fc2a017c5d597937e0c28b9a9669844aa796c42\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b4b01b4995fb15b55a2d067eb405917f5ab32709\",\n                            \"lessThan\": \"2757e6e803092cf0aeaf4b735e16b5d3bdc705c5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b4b01b4995fb15b55a2d067eb405917f5ab32709\",\n                            \"lessThan\": \"35be0e2c6862abcd5e5f5445261f1fd910d4a9b4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b4b01b4995fb15b55a2d067eb405917f5ab32709\",\n                            \"lessThan\": \"375c1934ef0196d3b6d3a1eae3232bef8dae7bf7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b4b01b4995fb15b55a2d067eb405917f5ab32709\",\n                            \"lessThan\": \"4e1a53892ba7f8a3e1da6bfc53c83ae7c812dccd\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/virtio/virtgpu_vq.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.0\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.0\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.266\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.217\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.183\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.148\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.101\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.42\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.6\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","score":7.7,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/65ce911f341ad8ff0c08922eff5bb6db75666eb0","https://git.kernel.org/stable/c/64bedd2758eccbc74d39f7006a7ec16fa39dc901","https://git.kernel.org/stable/c/3f506a85a905b080cadc029a1651a310479090a6","https://git.kernel.org/stable/c/9fc2a017c5d597937e0c28b9a9669844aa796c42","https://git.kernel.org/stable/c/2757e6e803092cf0aeaf4b735e16b5d3bdc705c5","https://git.kernel.org/stable/c/35be0e2c6862abcd5e5f5445261f1fd910d4a9b4","https://git.kernel.org/stable/c/375c1934ef0196d3b6d3a1eae3232bef8dae7bf7","https://git.kernel.org/stable/c/4e1a53892ba7f8a3e1da6bfc53c83ae7c812dccd"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68255","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-68255","identifiers":["CVE-2026-68255"]},"retained":false,"historicalAffected":[]}],"coverage":[]}