CVE-2026-68255
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In the Linux kernel, the drm/virtio driver has an out-of-bounds read vulnerability in virtio_get_edid_block(). The function validates the read offset only against the device-supplied resp->size field, not against the fixed-size resp->edid array. A malicious virtio-gpu backend can advertise a large size and high block count, leading to reads past the array and an info leak from kernel memory.
Risk Assessment
The risk includes kernel memory information disclosure, which could expose sensitive data. In virtualized environments with virtio-gpu, an attacker could exploit this to gain unauthorized access to data.
Recommendation
It is recommended to apply a Linux kernel update containing the fix that rejects reads exceeding the edid array size. Also, limit trust in virtio-gpu backends.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: bound EDID block reads to the response buffer virtio_get_edid_block() validates the read offset only against the device-supplied resp->size field, never against the fixed-size resp->edid array. The EDID block index is driven by the device-supplied extension count, so a malicious virtio-gpu backend can advertise a large size together with a high block count and read far past the array into adjacent kernel memory, which is then surfaced in the parsed EDID (an out-of-bounds read / info leak). Also reject any read whose end exceeds the size of the edid array. Conforming EDID responses stay within the array and are unaffected.