CVE-2026-64524: drm/hyperv: validate resolution_count and fix WIN8 fallback

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/hyperv: validate resolution_count and fix WIN8 fallback

A SYNTHVID_RESOLUTION_RESPONSE with resolution_count > 64 walks past
the supported_resolution[SYNTHVID_MAX_RESOLUTION_COUNT] array in the
parse loop. Bound resolution_count against the array size, folded
into the existing zero-check.

When the WIN10 resolution probe fails, the caller in
hyperv_connect_vsp() left hv->screen_*_max / preferred_* unpopulated,
which sets mode_config.max_width / max_height to 0 and makes
drm_internal_framebuffer_create() reject every userspace framebuffer
with -EINVAL. The pre-WIN10 branch had the same gap for
preferred_width / preferred_height. Use a single post-probe fallback
guarded by screen_width_max == 0 so both paths converge on the WIN8
defaults.

The Linux kernel CVE team has assigned CVE-2026-64524 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.14 with commit 76c56a5affeba1e163b66b9d8cc192e6154466f0 and fixed in 5.15.210 with commit 96f7de3172d4aa878b7f87173b2b3507c350fcd6
	Issue introduced in 5.14 with commit 76c56a5affeba1e163b66b9d8cc192e6154466f0 and fixed in 6.1.176 with commit bc573752f3dac0d1ab8df7078c1851bc76717653
	Issue introduced in 5.14 with commit 76c56a5affeba1e163b66b9d8cc192e6154466f0 and fixed in 6.6.143 with commit 1fb565b77b8f44afabb02de6310065f109d89e94
	Issue introduced in 5.14 with commit 76c56a5affeba1e163b66b9d8cc192e6154466f0 and fixed in 6.12.93 with commit a321c908f2eeea01539668eb270d074d9b88e490
	Issue introduced in 5.14 with commit 76c56a5affeba1e163b66b9d8cc192e6154466f0 and fixed in 6.18.35 with commit 9c698b2c43c2667c34f5336bf46ad5786216ac2a
	Issue introduced in 5.14 with commit 76c56a5affeba1e163b66b9d8cc192e6154466f0 and fixed in 7.0.12 with commit 8a114b25b5521eae451b13bce98ae978624962e5
	Issue introduced in 5.14 with commit 76c56a5affeba1e163b66b9d8cc192e6154466f0 and fixed in 7.1 with commit 13d33b9ef67066c77c84273fac5a1d3fde3533d1

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64524
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/hyperv/hyperv_drm_proto.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/96f7de3172d4aa878b7f87173b2b3507c350fcd6
	https://git.kernel.org/stable/c/bc573752f3dac0d1ab8df7078c1851bc76717653
	https://git.kernel.org/stable/c/1fb565b77b8f44afabb02de6310065f109d89e94
	https://git.kernel.org/stable/c/a321c908f2eeea01539668eb270d074d9b88e490
	https://git.kernel.org/stable/c/9c698b2c43c2667c34f5336bf46ad5786216ac2a
	https://git.kernel.org/stable/c/8a114b25b5521eae451b13bce98ae978624962e5
	https://git.kernel.org/stable/c/13d33b9ef67066c77c84273fac5a1d3fde3533d1