CVE-2026-68255 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: bound EDID block reads to the response buffer
virtio_get_edid_block() validates the read offset only against the device-supplied resp->size field, never against the fixed-size resp->edid array. The EDID block index is driven by the device-supplied extension count, so a malicious virtio-gpu backend can advertise a large size together with a high block count and read far past the array into adjacent kernel memory, which is then surfaced in the parsed EDID (an out-of-bounds read / info leak).
Also reject any read whose end exceeds the size of the edid array. Conforming EDID responses stay within the array and are unaffected.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability resides within the linux kernel's drm/virtio subsystem where the virtio_get_edid_block() function fails to properly validate read operations against the response buffer boundaries. This flaw represents a classic out-of-bounds memory access issue that can lead to information disclosure through kernel memory leaks. The vulnerability specifically affects how the function handles EDID (Extended Display Identification Data) block reads, which are essential for display configuration in virtualized environments using virtio-gpu backends.
The technical implementation flaw occurs because the function only validates the read offset against the device-supplied resp->size field without considering the fixed-size resp->edid array boundaries. This validation gap allows malicious virtio-gpu backends to manipulate the extension count parameter, which drives the EDID block index, enabling them to specify large response sizes while maintaining a high block count. When combined, these parameters allow attackers to read beyond the allocated edid array boundaries and into adjacent kernel memory regions.
This vulnerability maps directly to CWE-125: Out-of-bounds Read, which is categorized under the broader issue of buffer over-read conditions in kernel space. The attack vector operates through the virtio-gpu backend interface where an attacker can craft malicious EDID responses with inflated size parameters and extension counts. The operational impact includes potential information leakage from kernel memory spaces that could contain sensitive data such as kernel pointers, stack contents, or other confidential information.
The security implications extend beyond simple information disclosure to potentially enable more sophisticated attacks by exposing kernel memory layout details that could aid in privilege escalation or bypass mechanisms. According to ATT&CK framework, this vulnerability aligns with T1068: Exploitation for Privilege Escalation and T1552: Unsecured Credentials, as the information leak can provide attackers with valuable insights into system memory structures and potential credential locations.
The fix implemented addresses both the root cause and operational impact by adding explicit validation that rejects any read operation whose end position exceeds the actual size of the edid array. This mitigation ensures that all EDID block reads remain strictly within the bounds of the allocated buffer while maintaining compatibility with standard EDID responses that naturally stay within array boundaries. The solution prevents the out-of-bounds access pattern that previously allowed reading into adjacent kernel memory, effectively closing the information leak channel without disrupting legitimate functionality.
This vulnerability demonstrates the critical importance of proper input validation in kernel space operations, particularly when dealing with device-supplied parameters that can be manipulated by untrusted entities. The fix exemplifies defensive programming practices recommended for kernel development, where all user-provided data must be validated against fixed boundaries regardless of device claims or expected behavior patterns. The resolution maintains system integrity while preserving the legitimate functionality of EDID processing in virtualized graphics environments.