CVE-2026-53135
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs [Why & How] dp_sdp_message_debugfs_write() dereferences connector->base.state->crtc without checking for NULL. A connector can be connected but not bound to any CRTC (e.g. after hot-plug before the next atomic commit), causing a kernel crash when writing to the sdp_message debugfs node. The function also ignores the user-provided size argument and always passes 36 bytes to copy_from_user(), reading past the user buffer when size < 36. Fix both issues by: - Returning -ENODEV when connector->base.state or state->crtc is NULL - Clamping write_size to min(size, sizeof(data)) (cherry picked from commit 6ab4c36a522842ff70474a1c0af2e40e50fc8300)
How to fix
- linux linux_kernel5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13 or later
- git.kernel.org/stable/c/7ae95c0275c330b5dbae806f8e431720edad776f
- git.kernel.org/stable/c/7fc4fab4acc307ad2903312c195872b2953d32c3
- git.kernel.org/stable/c/a2de1d71891a038a9346b2c1a72b88c8350f2479
- git.kernel.org/stable/c/adf67034b1f61f7119295208085bfd43f85f56af
- git.kernel.org/stable/c/b781f90a9528555c709e59789550893581ef0be4
- git.kernel.org/stable/c/bb6f705b73b5f191f14ad004e2c8c4b615806187
- git.kernel.org/stable/c/c90954cdea4d6998ec345de0d840d030c145b89e
- git.kernel.org/stable/c/ee9cfcf77a8e8af637396dc00966df5f701e661c
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 5.2 ≤ v < 5.10.259, 5.11 ≤ v < 5.15.210, 5.16 ≤ v < 6.1.176, 6.2 ≤ v < 6.6.143, 6.7 ≤ v < 6.12.94, 6.13 ≤ v < 6.18.36, 6.19 ≤ v < 7.0.13, 7.1 | 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.