CVE-2026-68279

A flaw was found in the Linux kernel's DisplayPort (DP) Multi-Stream Transport (MST) subsystem. A malicious or misbehaving MST hub could send a specially crafted sideband message that causes an out-of-bounds read in the drm_dp_sideband_parse_remote_dpcd_read() and drm_dp_sideband_parse_remote_i2c_read_ack() functions. This vulnerability allows the system to read past the intended data, potentially leading to information disclosure or system instability.

This issue affects DisplayPort MST. Remote DPCD/I2C sideband reply parsers read num_bytes without checking message bounds. Malicious or buggy MST hubs can trigger OOB reads.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.