Vulnerability-Lookup

GHSA-4QVV-F8J2-942J

Vulnerability from github – Published: 2026-09-03 15:32 – Updated: 2026-09-04 06:31

Details

In the Linux kernel, the following vulnerability has been resolved:

drm/connector/hdmi: Fix out of bounds memory read

A helper function was copying a given audio infoframe into the connector's copy but using the size of the destination (a generic target, sized to accept many different data blocks) not the source (a very specific type of data block). Thus, it was copying 60 bytes of data from a 28 byte allocation.

Fix that by using the source size instead, together with a build bug on the source size actually being smaller than the destination.

I hit this running KUnit tests under KASAN (while debugging something else entirely). In the real world, it seems unlikely to cause an actual problem. It is a read not a write so it can't corrupt any memory. However, it could potentially fall off the end of a page and cause an accvio bug.

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-80749"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-03T13:06:14Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/connector/hdmi: Fix out of bounds memory read\n\nA helper function was copying a given audio infoframe into the\nconnector\u0027s copy but using the size of the destination (a generic\ntarget, sized to accept many different data blocks) not the source (a\nvery specific type of data block). Thus, it was copying 60 bytes of\ndata from a 28 byte allocation.\n\nFix that by using the source size instead, together with a build bug\non the source size actually being smaller than the destination.\n\nI hit this running KUnit tests under KASAN (while debugging something\nelse entirely). In the real world, it seems unlikely to cause an\nactual problem. It is a read not a write so it can\u0027t corrupt any\nmemory. However, it could potentially fall off the end of a page and\ncause an accvio bug.",
  "id": "GHSA-4qvv-f8j2-942j",
  "modified": "2026-09-04T06:31:20Z",
  "published": "2026-09-03T15:32:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80749"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9ecf8ba763d0ffe0673538eb4bf7806f20455d19"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d9f7454c185c0c7f0973e11d62ad6c06862c324c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e5b527804a1ea4f70e139179d3062cf5de8c06ab"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f72bb95732bc5ca87b50c52c8f087ba501950809"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-80749 (GCVE-0-2026-80749)

Vulnerability from cvelistv5 – Published: 2026-09-03 08:26 – Updated: 2026-09-04 04:58

Title

drm/connector/hdmi: Fix out of bounds memory read

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/connector/hdmi: Fix out of bounds memory read A helper function was copying a given audio infoframe into the connector's copy but using the size of the destination (a generic target, sized to accept many different data blocks) not the source (a very specific type of data block). Thus, it was copying 60 bytes of data from a 28 byte allocation. Fix that by using the source size instead, together with a build bug on the source size actually being smaller than the destination. I hit this running KUnit tests under KASAN (while debugging something else entirely). In the real world, it seems unlikely to cause an actual problem. It is a read not a write so it can't corrupt any memory. However, it could potentially fall off the end of a page and cause an accvio bug.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/d9f7454c185c0c7f0…
https://git.kernel.org/stable/c/e5b527804a1ea4f70…
https://git.kernel.org/stable/c/f72bb95732bc5ca87…
https://git.kernel.org/stable/c/9ecf8ba763d0ffe06…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f378b77227bc4732922c57f92be89438bb1018a1 , < d9f7454c185c0c7f0973e11d62ad6c06862c324c (git) Affected: f378b77227bc4732922c57f92be89438bb1018a1 , < e5b527804a1ea4f70e139179d3062cf5de8c06ab (git) Affected: f378b77227bc4732922c57f92be89438bb1018a1 , < f72bb95732bc5ca87b50c52c8f087ba501950809 (git) Affected: f378b77227bc4732922c57f92be89438bb1018a1 , < 9ecf8ba763d0ffe0673538eb4bf7806f20455d19 (git)
Linux	Linux	Affected: 6.11 Unaffected: 0 , < 6.11 (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/display/drm_hdmi_state_helper.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d9f7454c185c0c7f0973e11d62ad6c06862c324c",
              "status": "affected",
              "version": "f378b77227bc4732922c57f92be89438bb1018a1",
              "versionType": "git"
            },
            {
              "lessThan": "e5b527804a1ea4f70e139179d3062cf5de8c06ab",
              "status": "affected",
              "version": "f378b77227bc4732922c57f92be89438bb1018a1",
              "versionType": "git"
            },
            {
              "lessThan": "f72bb95732bc5ca87b50c52c8f087ba501950809",
              "status": "affected",
              "version": "f378b77227bc4732922c57f92be89438bb1018a1",
              "versionType": "git"
            },
            {
              "lessThan": "9ecf8ba763d0ffe0673538eb4bf7806f20455d19",
              "status": "affected",
              "version": "f378b77227bc4732922c57f92be89438bb1018a1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/display/drm_hdmi_state_helper.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/connector/hdmi: Fix out of bounds memory read\n\nA helper function was copying a given audio infoframe into the\nconnector\u0027s copy but using the size of the destination (a generic\ntarget, sized to accept many different data blocks) not the source (a\nvery specific type of data block). Thus, it was copying 60 bytes of\ndata from a 28 byte allocation.\n\nFix that by using the source size instead, together with a build bug\non the source size actually being smaller than the destination.\n\nI hit this running KUnit tests under KASAN (while debugging something\nelse entirely). In the real world, it seems unlikely to cause an\nactual problem. It is a read not a write so it can\u0027t corrupt any\nmemory. However, it could potentially fall off the end of a page and\ncause an accvio bug."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via the ALSA PCM prepare path (SNDRV_PCM_IOCTL_PREPARE) through hdmi-codec into DRM HDMI audio prepare callbacks; it is not reachable from network protocols or remote packet handling.\nAC:L - Any local caller that can prepare HDMI audio reliably hits the faulty memcpy on every invocation; no special memory layout, timing window, or rare kernel configuration is required beyond having a supported HDMI audio driver loaded.\nPR:L - Triggering the path requires only access to ALSA PCM devices (/dev/snd/pcm*) to start HDMI audio playback, which typical unprivileged desktop, mobile, and embedded users already have without real root or init-namespace capabilities.\nUI:N - Exploitation is self-contained: the attacker prepares or starts HDMI audio playback themselves and does not depend on a separate victim performing an additional action beyond normal attacker-controlled playback setup.\nS:U - Impact is confined to kernel memory read and possible local kernel fault within the same privilege domain; it does not cross VM, IOMMU, or sandbox boundaries into another security authority.\nC:H - The vulnerable memcpy reads 60 bytes from a 28-byte hdmi_audio_infoframe, causing a 32-byte out-of-bounds kernel stack read whose contents are copied into connector state; OOB reads are rated High unless strictly limited to a few bytes.\nI:N - This is an out-of-bounds read, not an out-of-bounds write or use-after-free; kernel memory is not corrupted and no arbitrary write or control-flow hijack primitive is created, only mis-sized copying into an intended destination buffer.\nA:H - The over-read can cross a page boundary and fault (as noted by the fix author), producing a kernel oops/access violation; any kernel crash from memory access violations is rated High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T04:58:29.179Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d9f7454c185c0c7f0973e11d62ad6c06862c324c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5b527804a1ea4f70e139179d3062cf5de8c06ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/f72bb95732bc5ca87b50c52c8f087ba501950809"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ecf8ba763d0ffe0673538eb4bf7806f20455d19"
        }
      ],
      "title": "drm/connector/hdmi: Fix out of bounds memory read",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80749",
    "datePublished": "2026-09-03T08:26:30.140Z",
    "dateReserved": "2026-08-26T14:34:25.790Z",
    "dateUpdated": "2026-09-04T04:58:29.179Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-4QVV-F8J2-942J

CVE-2026-80749 (GCVE-0-2026-80749)

Tags

Sightings

Nomenclature