CVE-2026-64219 (CVSS 7)

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async [Why&How] dc_process_dmub_aux_transfer_async() copies payload->length bytes into a 16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(), which is a no-op in release builds. If a caller ever passes length > 16 this results in a stack buffer overflow via memcpy. Additionally, link_index is used to dereference dc->links[] without bounds checking against dc->link_count, risking an out-of-bounds access. Replace the ASSERT with a hard runtime check that returns false when payload->length exceeds the destination buffer size, and add a bounds check for link_index before it is used. (cherry picked from commit ba4caa9fecdf7a38f98c878ad05a8a64148b6881)

Is your site exposed to CVE-2026-64219?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.0

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0014

Probability of exploitation

0.03%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/16a5fa57565afb6bf37e18129921c270c93d8e2b https://git.kernel.org/stable/c/1c8c6e912f2945b2a3e669afca6b52174b88e86e https://git.kernel.org/stable/c/1ecde19bfce6535bffddad1139ff466b6d401b8e https://git.kernel.org/stable/c/3265f3ed373fb8048be713aadcdf702579a0e53d https://git.kernel.org/stable/c/6c92f6d9600efa3ef0d9e560a2b52776d9803c29 https://git.kernel.org/stable/c/90c398e822ca76e40548df0c061dd4f93ea92d71 https://git.kernel.org/stable/c/d6590e3f766e3111dd1beaf88b9384d117acfa6b

Frequently Asked Questions

What is CVE-2026-64219? +

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async [Why&How] dc_process_dmub_aux_transfer_async() copies payload->length bytes into a 16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(), which is a no-op in release builds. If a caller ever passes length > 16 this results in a stack buffer overflow via memcpy. Additionally, link_index is used to dereference dc->links[] without bounds checking against dc->link_count, risking an out-of-bounds access. Replace the ASSERT with a hard runtime check that returns false when payload->length exceeds the destination buffer size, and add a bounds check for link_index before it is used. (cherry picked from commit ba4caa9fecdf7a38f98c878ad05a8a64148b6881) It has a CVSS v3.1 base score of 7.0 (HIGH).

How severe is CVE-2026-64219? +

CVE-2026-64219 has a CVSS v3.1 score of 7.0 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0014, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-64219? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-64219