CVE-2026-68255

A flaw was found in the kernel. A malicious virtio-gpu backend can exploit an out-of-bounds read vulnerability in the drm/virtio component of the Linux kernel. By manipulating the Extended Display Identification Data (EDID) block index and advertising a large size, the backend can read beyond the intended buffer into adjacent kernel memory. This leads to information disclosure, where sensitive kernel memory contents are exposed.

This issue affects virtio-gpu guests. virtio_get_edid_block() does not bound reads to the fixed EDID response array; a malicious hypervisor backend can trigger OOB read. Virtio-gpu guests are affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.