← Back to CVE Explorer

CVE-2026-68255

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: bound EDID block reads to the response buffer virtio_get_edid_block() validates the read offset only against the device-supplied resp->size field, never against the fixed-size resp->edid array. The EDID block index is driven by the device-supplied extension count, so a malicious virtio-gpu backend can advertise a large size together with a high block count and read far past the array into adjacent kernel memory, which is then surfaced in the parsed EDID (an out-of-bounds read / info leak). Also reject any read whose end exceeds the size of the edid array. Conforming EDID responses stay within the array and are unaffected.

Severity
HIGH
CVSS score
7.7 (v3.1)
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-08-10 13:20:14.113000
Last modified
2026-10-19 21:17:59.447000
View original CVE JSON 
{
  "id": "CVE-2026-68255",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-08-10T13:20:14.113",
  "lastModified": "2026-10-19T21:17:59.447",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: bound EDID block reads to the response buffer\n\nvirtio_get_edid_block() validates the read offset only against the\ndevice-supplied resp->size field, never against the fixed-size resp->edid\narray. The EDID block index is driven by the device-supplied extension\ncount, so a malicious virtio-gpu backend can advertise a large size\ntogether with a high block count and read far past the array into adjacent\nkernel memory, which is then surfaced in the parsed EDID (an out-of-bounds\nread / info leak).\n\nAlso reject any read whose end exceeds the size of the edid array.\nConforming EDID responses stay within the array and are unaffected."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/gpu/drm/virtio/virtgpu_vq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "b4b01b4995fb15b55a2d067eb405917f5ab32709",
              "lessThan": "65ce911f341ad8ff0c08922eff5bb6db75666eb0",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b4b01b4995fb15b55a2d067eb405917f5ab32709",
              "lessThan": "64bedd2758eccbc74d39f7006a7ec16fa39dc901",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b4b01b4995fb15b55a2d067eb405917f5ab32709",
              "lessThan": "3f506a85a905b080cadc029a1651a310479090a6",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b4b01b4995fb15b55a2d067eb405917f5ab32709",
              "lessThan": "9fc2a017c5d597937e0c28b9a9669844aa796c42",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b4b01b4995fb15b55a2d067eb405917f5ab32709",
              "lessThan": "2757e6e803092cf0aeaf4b735e16b5d3bdc705c5",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b4b01b4995fb15b55a2d067eb405917f5ab32709",
              "lessThan": "35be0e2c6862abcd5e5f5445261f1fd910d4a9b4",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b4b01b4995fb15b55a2d067eb405917f5ab32709",
              "lessThan": "375c1934ef0196d3b6d3a1eae3232bef8dae7bf7",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b4b01b4995fb15b55a2d067eb405917f5ab32709",
              "lessThan": "4e1a53892ba7f8a3e1da6bfc53c83ae7c812dccd",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/gpu/drm/virtio/virtgpu_vq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "5.0",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "5.0",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.266",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.217",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.183",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.148",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.101",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.42",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.1.6",
              "lessThanOrEqual": "7.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-16T15:46:13.291191Z",
          "id": "CVE-2026-68255",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2757e6e803092cf0aeaf4b735e16b5d3bdc705c5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/35be0e2c6862abcd5e5f5445261f1fd910d4a9b4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/375c1934ef0196d3b6d3a1eae3232bef8dae7bf7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3f506a85a905b080cadc029a1651a310479090a6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4e1a53892ba7f8a3e1da6bfc53c83ae7c812dccd",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/64bedd2758eccbc74d39f7006a7ec16fa39dc901",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/65ce911f341ad8ff0c08922eff5bb6db75666eb0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9fc2a017c5d597937e0c28b9a9669844aa796c42",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}