CVE-2026-64219: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async

[Why&How]
dc_process_dmub_aux_transfer_async() copies payload->length bytes into a
16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(), which
is a no-op in release builds. If a caller ever passes length > 16 this
results in a stack buffer overflow via memcpy.

Additionally, link_index is used to dereference dc->links[] without
bounds checking against dc->link_count, risking an out-of-bounds access.

Replace the ASSERT with a hard runtime check that returns false when
payload->length exceeds the destination buffer size, and add a bounds
check for link_index before it is used.

(cherry picked from commit ba4caa9fecdf7a38f98c878ad05a8a64148b6881)

The Linux kernel CVE team has assigned CVE-2026-64219 to this issue.


Affected and fixed versions
===========================

	Fixed in 5.15.209 with commit d6590e3f766e3111dd1beaf88b9384d117acfa6b
	Fixed in 6.1.175 with commit 16a5fa57565afb6bf37e18129921c270c93d8e2b
	Fixed in 6.6.142 with commit 90c398e822ca76e40548df0c061dd4f93ea92d71
	Fixed in 6.12.92 with commit 3265f3ed373fb8048be713aadcdf702579a0e53d
	Fixed in 6.18.34 with commit 1ecde19bfce6535bffddad1139ff466b6d401b8e
	Fixed in 7.0.11 with commit 1c8c6e912f2945b2a3e669afca6b52174b88e86e
	Fixed in 7.1 with commit 6c92f6d9600efa3ef0d9e560a2b52776d9803c29

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64219
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/amd/display/dc/core/dc.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/d6590e3f766e3111dd1beaf88b9384d117acfa6b
	https://git.kernel.org/stable/c/16a5fa57565afb6bf37e18129921c270c93d8e2b
	https://git.kernel.org/stable/c/90c398e822ca76e40548df0c061dd4f93ea92d71
	https://git.kernel.org/stable/c/3265f3ed373fb8048be713aadcdf702579a0e53d
	https://git.kernel.org/stable/c/1ecde19bfce6535bffddad1139ff466b6d401b8e
	https://git.kernel.org/stable/c/1c8c6e912f2945b2a3e669afca6b52174b88e86e
	https://git.kernel.org/stable/c/6c92f6d9600efa3ef0d9e560a2b52776d9803c29