HIGH Introduced in 5.4
drm AuxRead Overflow
CVE-2026-93067
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: drm/bridge: tc358767: clamp the reported AUX read size to the request tc_aux_transfer() clamps an AUX read to the payload limit: size_t size = min_t(size_t, DP_AUX_MAX_PAYLOAD_BYTES - 1, msg->size); After the transfer it replaces size with the byte count the controller reports in AUX_BYTES: if (size) size = FIELD_GET(AUX_BYTES, auxstatus); AUX_BYTES is GENMASK(15, 8), so it can be up to 255. Nothing clamps it back to the request. tc_aux_read_data() reads that many bytes into the 16-byte auxrdata stack buffer, then copies them into the caller buffer. A reported count of 255 makes the read run to 256 bytes and overruns both. The controller should never report more than it was asked to transfer, so this is defense in depth rather than a live hole. The reported count is only lightly trusted, and the check is cheap. Clamp it back to the request, the same way ti-sn65dsi86 does in commit aca58eac52b8 ("drm/bridge: ti-sn65dsi86: Never store more than msg->size bytes in AUX xfer").
02KernelScan AI Analysis
Risk summary
A stack buffer overflow in the TC358767 DisplayPort bridge driver can be triggered when the bridge controller reports more AUX read bytes than were requested. An attacker with physical access to the DisplayPort port could connect a malicious device that sends an oversized AUX response, corrupting kernel stack memory and potentially achieving code execution or crashing the kernel. Products without this specific bridge chip are unaffected.
Vulnerability analysis
After completing a DisplayPort AUX channel read transfer, the TC358767 bridge driver replaces the originally requested byte count with the byte count reported by the bridge controller in a status register. That reported count can be up to 255, but the driver reads the data into a 16-byte stack buffer and then copies it into the caller's buffer — if the controller reports more bytes than were requested, both buffers are overrun. The fix clamps the reported count to the minimum of the original request size and the controller-reported value, ensuring the read never exceeds what was asked for. The commit notes this is defense in depth since a well-behaved controller should never over-report, but the register field is only lightly trusted. Exploitation requires a system equipped with the TC358767 bridge chip and physical access to the DisplayPort connector to attach a malicious device that sends an oversized AUX response.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.4 | 5.10.270 | ebf00c51c9ac |
| 5.15 | 5.4 | 5.15.221 | 424b762cc26d |
| 6.1 | 5.4 | 6.1.188 | dd6274706bec |
| 6.12 | 5.4 | 6.12.110 | 33c0b072e31d |
| 6.18 | 5.4 | 6.18.52 | 57c567e0e8aa |
| 6.6 | 5.4 | 6.6.157 | 982caa744fce |
| 7.2 | 5.4 | 7.2.6 | 9ff718df5473 |
| mainline | 5.4 | 7.3 | ec6444a00c49 |
| cip/5.10 | 5.4 | 5.10.271-cip78 | ebf00c51c9ac |
| cip/6.1 | 5.4 | 6.1.189-cip61 | dd6274706bec |
| cip/6.1-rt | 5.4 | 6.1.189-cip61-rt32 | dd6274706bec |
| cip/6.12 | 5.4 | 6.12.111-cip32 | 33c0b072e31d |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |