CVE-2026-68253 (GCVE-0-2026-68253)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:01 – Updated: 2026-08-23 12:46
VLAI
Title
drm/i915/hdcp: check streams[] bounds before overflow
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/i915/hdcp: check streams[] bounds before overflow The data->streams[] overflow check is done after the buffer overflow has already happened. Move the overflow check before the write. Side note, emitting a warning splat with a backtrace might be overkill here, but prefer not changing the behaviour other than not doing the overrun. Discovered using AI-assisted static analysis confirmed by Intel Product Security. (cherry picked from commit 9284ab3b6e776c315883ac2611283d263c9460fd)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9 , < 336cf6d80d41457442b659e7ba7a7badc0ffe79d (git)
Affected: e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9 , < 389079bf04e6f0c6f10f5b879f6d7a9cf80f0567 (git)
Affected: e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9 , < 84351f12390349ba010920fc247e1a0b12e41eb3 (git)
Affected: e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9 , < 2106fb490b2c6003e23ad6ff36ce823a2170e138 (git)
Affected: e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9 , < 3d2ef8d389495e7889c6062d8bddc46d2a5fbdef (git)
Affected: e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9 , < 984085c5b53572e2e03fd5fc4817e86ef1effc6e (git)
Affected: e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9 , < bbb15a6b042d02e5508a02b4847e02d2579ee7bc (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.12
Unaffected: 0 , < 5.12 (semver)
Unaffected: 5.15.217 , ≤ 5.15.* (semver)
Unaffected: 6.1.184 , ≤ 6.1.* (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/display/intel_hdcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "336cf6d80d41457442b659e7ba7a7badc0ffe79d",
              "status": "affected",
              "version": "e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9",
              "versionType": "git"
            },
            {
              "lessThan": "389079bf04e6f0c6f10f5b879f6d7a9cf80f0567",
              "status": "affected",
              "version": "e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9",
              "versionType": "git"
            },
            {
              "lessThan": "84351f12390349ba010920fc247e1a0b12e41eb3",
              "status": "affected",
              "version": "e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9",
              "versionType": "git"
            },
            {
              "lessThan": "2106fb490b2c6003e23ad6ff36ce823a2170e138",
              "status": "affected",
              "version": "e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9",
              "versionType": "git"
            },
            {
              "lessThan": "3d2ef8d389495e7889c6062d8bddc46d2a5fbdef",
              "status": "affected",
              "version": "e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9",
              "versionType": "git"
            },
            {
              "lessThan": "984085c5b53572e2e03fd5fc4817e86ef1effc6e",
              "status": "affected",
              "version": "e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9",
              "versionType": "git"
            },
            {
              "lessThan": "bbb15a6b042d02e5508a02b4847e02d2579ee7bc",
              "status": "affected",
              "version": "e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/display/intel_hdcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/hdcp: check streams[] bounds before overflow\n\nThe data-\u003estreams[] overflow check is done after the buffer overflow has\nalready happened. Move the overflow check before the write.\n\nSide note, emitting a warning splat with a backtrace might be overkill\nhere, but prefer not changing the behaviour other than not doing the\noverrun.\n\nDiscovered using AI-assisted static analysis confirmed by Intel Product\nSecurity.\n\n(cherry picked from commit 9284ab3b6e776c315883ac2611283d263c9460fd)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflow is reached through a local DRM atomic modeset ioctl on /dev/dri/cardN that sets the \"Content Protection\" connector property, driving intel_hdcp_enable() -\u003e intel_hdcp_prepare_streams(); no network or remote path exists to the i915 display HDCP code.\nAC:L - Any DP MST topology with more connected MST connectors on one digital port than the device has pipes (a common dock/hub/daisy-chain setup, and easily arranged by anyone with access to the machine\u0027s display outputs) makes every HDCP enable request overflow the buffer deterministically, with no race or memory-layout condition to win.\nPR:L - The attacker only needs access to the DRM device node as DRM master, which an ordinary user in a local graphical session (video/render group, logind seat) has; no CAP_SYS_ADMIN or root is required to request HDCP content protection on an MST connector.\nUI:N - The attacker performs the atomic commit that requests content protection themselves; no action by another user is needed, and on a system already running a compositor with HDCP desired the overflow occurs automatically on the modeset.\nS:U - The corruption is confined to kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The out-of-bounds write corrupts adjacent objects in a small kmalloc slab, and such heap corruption is a standard primitive for pivoting to arbitrary kernel memory disclosure by overwriting neighbouring pointers or length fields.\nI:H - This is a heap out-of-bounds write past a kzalloc\u0027d streams[] buffer sized to INTEL_NUM_PIPES, with attacker-influenced VCPI values and an attacker-controlled overflow length determined by the MST topology, giving corruption of adjacent slab objects that can be leveraged for control-flow hijack.\nA:H - Overwriting adjacent slab allocations reliably produces slab corruption, oops, or panic, and the path can be re-triggered on every HDCP enable/modeset, so the system can be crashed repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:46:11.002Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/336cf6d80d41457442b659e7ba7a7badc0ffe79d"
        },
        {
          "url": "https://git.kernel.org/stable/c/389079bf04e6f0c6f10f5b879f6d7a9cf80f0567"
        },
        {
          "url": "https://git.kernel.org/stable/c/84351f12390349ba010920fc247e1a0b12e41eb3"
        },
        {
          "url": "https://git.kernel.org/stable/c/2106fb490b2c6003e23ad6ff36ce823a2170e138"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d2ef8d389495e7889c6062d8bddc46d2a5fbdef"
        },
        {
          "url": "https://git.kernel.org/stable/c/984085c5b53572e2e03fd5fc4817e86ef1effc6e"
        },
        {
          "url": "https://git.kernel.org/stable/c/bbb15a6b042d02e5508a02b4847e02d2579ee7bc"
        }
      ],
      "title": "drm/i915/hdcp: check streams[] bounds before overflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68253",
    "datePublished": "2026-08-10T12:01:19.402Z",
    "dateReserved": "2026-07-30T09:28:09.377Z",
    "dateUpdated": "2026-08-23T12:46:11.002Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68253",
      "date": "2026-09-22",
      "epss": "0.00143",
      "percentile": "0.03943"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:46:47.000Z",
      "cve": "CVE-2026-68253",
      "id": "msrc_CVE-2026-68253",
      "initial_release_date": "2026-08-11T01:15:25.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/i915/hdcp: check streams[] bounds before overflow",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-68253.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/i915/display/intel_hdcp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "336cf6d80d41457442b659e7ba7a7badc0ffe79d",
                    "status": "affected",
                    "version": "e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "389079bf04e6f0c6f10f5b879f6d7a9cf80f0567",
                    "status": "affected",
                    "version": "e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "84351f12390349ba010920fc247e1a0b12e41eb3",
                    "status": "affected",
                    "version": "e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2106fb490b2c6003e23ad6ff36ce823a2170e138",
                    "status": "affected",
                    "version": "e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3d2ef8d389495e7889c6062d8bddc46d2a5fbdef",
                    "status": "affected",
                    "version": "e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "984085c5b53572e2e03fd5fc4817e86ef1effc6e",
                    "status": "affected",
                    "version": "e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bbb15a6b042d02e5508a02b4847e02d2579ee7bc",
                    "status": "affected",
                    "version": "e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/i915/display/intel_hdcp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.12"
                  },
                  {
                    "lessThan": "5.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.217",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.184",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.151",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/hdcp: check streams[] bounds before overflow\n\nThe data-\u003estreams[] overflow check is done after the buffer overflow has\nalready happened. Move the overflow check before the write.\n\nSide note, emitting a warning splat with a backtrace might be overkill\nhere, but prefer not changing the behaviour other than not doing the\noverrun.\n\nDiscovered using AI-assisted static analysis confirmed by Intel Product\nSecurity.\n\n(cherry picked from commit 9284ab3b6e776c315883ac2611283d263c9460fd)"
          }
        ],
        "id": "CVE-2026-68253",
        "lastModified": "2026-08-23T13:16:35.467",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-10T13:20:13.860",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2106fb490b2c6003e23ad6ff36ce823a2170e138"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/336cf6d80d41457442b659e7ba7a7badc0ffe79d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/389079bf04e6f0c6f10f5b879f6d7a9cf80f0567"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3d2ef8d389495e7889c6062d8bddc46d2a5fbdef"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/84351f12390349ba010920fc247e1a0b12e41eb3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/984085c5b53572e2e03fd5fc4817e86ef1effc6e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bbb15a6b042d02e5508a02b4847e02d2579ee7bc"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T11:19:56+00:00",
      "cve": "CVE-2026-68253",
      "id": "CVE-2026-68253",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "45",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/i915/hdcp: check streams[] bounds before overflow",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68253.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-22T16:44:58Z",
      "cve": "CVE-2026-68253",
      "id": "CVE-2026-68253",
      "initial_release_date": "2026-08-14T23:45:36Z",
      "product_status:first_fixed": "60",
      "product_status:known_affected": "601",
      "product_status:known_not_affected": "147",
      "product_status:recommended": "83",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68253",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68253.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.