CVE-2026-64524

A flaw was found in the Linux kernel's drm/hyperv component. A malicious Hyper-V guest could exploit an out-of-bounds memory access vulnerability by sending a crafted resolution response. This could potentially lead to information disclosure or a denial of service. Additionally, an issue with the resolution probe fallback mechanism could prevent display functionality from initializing correctly, resulting in a denial of service.

This vulnerability is rated as Moderate severity because exploitation is restricted to virtualized environments running on Microsoft Hyper-V with the synthetic DRM video driver active, limiting the impact to a localized denial of service. Systems deployed on bare metal, alternative hypervisors, or running headless configurations without this driver loaded are unaffected. Furthermore, triggering the condition requires local privileges on the virtual machine, preventing unauthenticated remote exploitation or hypervisor escape.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.