CVE-2026-97621 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/rockchip: analogix_dp: fix unchecked bound endpoint name length
rockchip_dp_drm_encoder_enable() uses sprintf() to format a device tree path into a 32-byte stack buffer. Device tree paths are not limited to this size, so a sufficiently long path can overflow the buffer.
Use snprintf() with the destination size to truncate the generated name and keep the writes within bounds.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in the Linux kernel's DRM Rockchip driver involves a classic stack-based buffer overflow resulting from improper input validation during device tree path processing. Specifically, the function rockchip_dp_drm_encoder_enable() is responsible for initializing display encoder configurations by constructing a string representation of a device tree node path. This operation utilizes sprintf(), an unbounded formatting function that writes to a fixed-size 32-byte stack buffer without checking if the resulting string exceeds the allocated memory space. Since device tree paths can vary significantly in length depending on system configuration and hardware topology, there is no inherent upper limit guaranteeing compatibility with this small buffer size. Consequently, when a sufficiently long path is encountered, sprintf() writes beyond the boundaries of the stack-allocated array, leading to heap or stack corruption that compromises memory integrity.
From a technical perspective, this flaw represents an improper restriction of excessive resource consumption coupled with insufficient boundary checks on user-controlled data derived from system configuration files. The device tree serves as a critical interface for describing hardware components in embedded Linux systems, and its contents are often populated by board designers or automated build tools rather than direct end-user input. However, the principle of defense-in-depth dictates that software must validate all inputs regardless of their source to prevent exploitation through maliciously crafted configurations or compromised firmware images. The use of sprintf() here fails to enforce length constraints, allowing an attacker who can influence the device tree content to trigger a buffer overflow. This could potentially lead to arbitrary code execution if the overwritten stack data includes return addresses or function pointers, although in many embedded contexts it may primarily result in denial-of-service conditions due to kernel panics caused by memory corruption.
The operational impact of this vulnerability extends beyond immediate system stability. In production environments utilizing Rockchip-based SoCs for display output, such as digital signage, industrial control panels, or automotive infotainment systems, a successful exploit could disrupt critical visual interfaces. More severely, if the overflow corrupts adjacent kernel structures, it may allow privilege escalation from unprivileged processes to root level within the operating system. This is particularly concerning in multi-tenant environments where different security contexts rely on strict isolation boundaries enforced by the kernel memory manager. The lack of bounds checking means that even minor variations in device tree syntax or additional nested node levels can trigger this flaw, making it a persistent risk across various hardware revisions and software configurations until patched.
To mitigate this vulnerability, developers must replace sprintf() with snprintf(), specifying the destination buffer size as an argument to ensure that writes never exceed the allocated memory limits. This change enforces truncation of overly long paths rather than allowing uncontrolled expansion into adjacent stack frames. Beyond code-level fixes, system administrators and integrators should audit device tree source files for excessively deep or lengthy node names in critical display subsystems. Additionally, enabling kernel hardening features such as stack canaries and address space layout randomization provides supplementary protection against exploitation attempts by making it more difficult to predict memory layouts required for successful buffer overflow attacks. Regular updates to the Linux kernel are essential to maintain these protections, as upstream developers continuously refine input validation mechanisms across subsystems like DRM to align with secure coding standards.
This issue is categorized under CWE-120: Buffer Copy without Checking Size of Input (Classic Buffer Overflow) and maps to ATT&CK technique T1059: Command and Scripting Interpreter if leveraged for initial access via crafted device tree files in embedded systems, or more broadly to privilege escalation vectors involving memory corruption. The resolution underscores the importance of rigorous input validation even when dealing with internal system configurations that are assumed to be trusted. By adopting safer string handling functions like snprintf(), the Rockchip DRM driver now adheres to best practices for preventing buffer overflows, thereby enhancing the overall security posture of Linux-based embedded platforms relying on this display subsystem.