CVE-2026-68255: drm/virtio: bound EDID block reads to the response buffer

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: bound EDID block reads to the response buffer

virtio_get_edid_block() validates the read offset only against the
device-supplied resp->size field, never against the fixed-size resp->edid
array. The EDID block index is driven by the device-supplied extension
count, so a malicious virtio-gpu backend can advertise a large size
together with a high block count and read far past the array into adjacent
kernel memory, which is then surfaced in the parsed EDID (an out-of-bounds
read / info leak).

Also reject any read whose end exceeds the size of the edid array.
Conforming EDID responses stay within the array and are unaffected.

The Linux kernel CVE team has assigned CVE-2026-68255 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.0 with commit b4b01b4995fb15b55a2d067eb405917f5ab32709 and fixed in 6.6.148 with commit 9fc2a017c5d597937e0c28b9a9669844aa796c42
	Issue introduced in 5.0 with commit b4b01b4995fb15b55a2d067eb405917f5ab32709 and fixed in 6.12.101 with commit 2757e6e803092cf0aeaf4b735e16b5d3bdc705c5
	Issue introduced in 5.0 with commit b4b01b4995fb15b55a2d067eb405917f5ab32709 and fixed in 6.18.42 with commit 35be0e2c6862abcd5e5f5445261f1fd910d4a9b4
	Issue introduced in 5.0 with commit b4b01b4995fb15b55a2d067eb405917f5ab32709 and fixed in 7.1.6 with commit 375c1934ef0196d3b6d3a1eae3232bef8dae7bf7
	Issue introduced in 5.0 with commit b4b01b4995fb15b55a2d067eb405917f5ab32709 and fixed in 7.2-rc2 with commit 4e1a53892ba7f8a3e1da6bfc53c83ae7c812dccd

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68255
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/virtio/virtgpu_vq.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/9fc2a017c5d597937e0c28b9a9669844aa796c42
	https://git.kernel.org/stable/c/2757e6e803092cf0aeaf4b735e16b5d3bdc705c5
	https://git.kernel.org/stable/c/35be0e2c6862abcd5e5f5445261f1fd910d4a9b4
	https://git.kernel.org/stable/c/375c1934ef0196d3b6d3a1eae3232bef8dae7bf7
	https://git.kernel.org/stable/c/4e1a53892ba7f8a3e1da6bfc53c83ae7c812dccd