{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68253","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-30T09:28:09.377Z","datePublished":"2026-08-10T12:01:19.402Z","dateUpdated":"2026-08-23T12:46:11.002Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-23T12:46:11.002Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/hdcp: check streams[] bounds before overflow\n\nThe data->streams[] overflow check is done after the buffer overflow has\nalready happened. Move the overflow check before the write.\n\nSide note, emitting a warning splat with a backtrace might be overkill\nhere, but prefer not changing the behaviour other than not doing the\noverrun.\n\nDiscovered using AI-assisted static analysis confirmed by Intel Product\nSecurity.\n\n(cherry picked from commit 9284ab3b6e776c315883ac2611283d263c9460fd)"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The overflow is reached through a local DRM atomic modeset ioctl on /dev/dri/cardN that sets the \"Content Protection\" connector property, driving intel_hdcp_enable() -> intel_hdcp_prepare_streams(); no network or remote path exists to the i915 display HDCP code.\nAC:L - Any DP MST topology with more connected MST connectors on one digital port than the device has pipes (a common dock/hub/daisy-chain setup, and easily arranged by anyone with access to the machine's display outputs) makes every HDCP enable request overflow the buffer deterministically, with no race or memory-layout condition to win.\nPR:L - The attacker only needs access to the DRM device node as DRM master, which an ordinary user in a local graphical session (video/render group, logind seat) has; no CAP_SYS_ADMIN or root is required to request HDCP content protection on an MST connector.\nUI:N - The attacker performs the atomic commit that requests content protection themselves; no action by another user is needed, and on a system already running a compositor with HDCP desired the overflow occurs automatically on the modeset.\nS:U - The corruption is confined to kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The out-of-bounds write corrupts adjacent objects in a small kmalloc slab, and such heap corruption is a standard primitive for pivoting to arbitrary kernel memory disclosure by overwriting neighbouring pointers or length fields.\nI:H - This is a heap out-of-bounds write past a kzalloc'd streams[] buffer sized to INTEL_NUM_PIPES, with attacker-influenced VCPI values and an attacker-controlled overflow length determined by the MST topology, giving corruption of adjacent slab objects that can be leveraged for control-flow hijack.\nA:H - Overwriting adjacent slab allocations reliably produces slab corruption, oops, or panic, and the path can be re-triggered on every HDCP enable/modeset, so the system can be crashed repeatedly."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/i915/display/intel_hdcp.c"],"versions":[{"version":"e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9","lessThan":"336cf6d80d41457442b659e7ba7a7badc0ffe79d","status":"affected","versionType":"git"},{"version":"e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9","lessThan":"389079bf04e6f0c6f10f5b879f6d7a9cf80f0567","status":"affected","versionType":"git"},{"version":"e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9","lessThan":"84351f12390349ba010920fc247e1a0b12e41eb3","status":"affected","versionType":"git"},{"version":"e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9","lessThan":"2106fb490b2c6003e23ad6ff36ce823a2170e138","status":"affected","versionType":"git"},{"version":"e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9","lessThan":"3d2ef8d389495e7889c6062d8bddc46d2a5fbdef","status":"affected","versionType":"git"},{"version":"e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9","lessThan":"984085c5b53572e2e03fd5fc4817e86ef1effc6e","status":"affected","versionType":"git"},{"version":"e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9","lessThan":"bbb15a6b042d02e5508a02b4847e02d2579ee7bc","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/i915/display/intel_hdcp.c"],"versions":[{"version":"5.12","status":"affected"},{"version":"0","lessThan":"5.12","status":"unaffected","versionType":"semver"},{"version":"5.15.217","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.184","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"5.15.217"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"6.1.184"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"6.6.151"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"6.12.103"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/336cf6d80d41457442b659e7ba7a7badc0ffe79d"},{"url":"https://git.kernel.org/stable/c/389079bf04e6f0c6f10f5b879f6d7a9cf80f0567"},{"url":"https://git.kernel.org/stable/c/84351f12390349ba010920fc247e1a0b12e41eb3"},{"url":"https://git.kernel.org/stable/c/2106fb490b2c6003e23ad6ff36ce823a2170e138"},{"url":"https://git.kernel.org/stable/c/3d2ef8d389495e7889c6062d8bddc46d2a5fbdef"},{"url":"https://git.kernel.org/stable/c/984085c5b53572e2e03fd5fc4817e86ef1effc6e"},{"url":"https://git.kernel.org/stable/c/bbb15a6b042d02e5508a02b4847e02d2579ee7bc"}],"title":"drm/i915/hdcp: check streams[] bounds before overflow","x_generator":{"engine":"bippy-1.2.0"}}}}