CVE-2026-93067
kernel: drm/bridge: tc358767: clamp the reported AUX read size to the request
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 17, 2026
Updated · October 20, 2026
Description
A flaw was found in the Linux kernel's drm/bridge: tc358767 component. An issue in the tc_aux_transfer() function, specifically within tc_aux_read_data(), allows a connected DisplayPort (DP) AUX controller to report a read size larger than requested. This can lead to a buffer overflow when reading data into a fixed-size buffer, potentially causing memory corruption.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-787 · Out-of-bounds Write