CVE-2024-26914 (GCVE-0-2024-26914)

Vulnerability from cvelistv5 – Published: 2024-04-17 15:59 – Updated: 2026-08-05 11:28
VLAI
Title
drm/amd/display: fix incorrect mpc_combine array size
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix incorrect mpc_combine array size [why] MAX_SURFACES is per stream, while MAX_PLANES is per asic. The mpc_combine is an array that records all the planes per asic. Therefore MAX_PLANES should be used as the array size. Using MAX_SURFACES causes array overflow when there are more than 3 planes. [how] Use the MAX_PLANES for the mpc_combine array size.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:47 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c , < 0bd8ef618a42d7e6ea3f701065264e15678025e3 (git)
Affected: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c , < 39079fe8e660851abbafa90cd55cbf029210661f (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.15
Unaffected: 0 , < 4.15 (semver)
Unaffected: 6.7.6 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.456Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0bd8ef618a42d7e6ea3f701065264e15678025e3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/39079fe8e660851abbafa90cd55cbf029210661f"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26914",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:47:53.436948Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:32:51.667Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0bd8ef618a42d7e6ea3f701065264e15678025e3",
              "status": "affected",
              "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
              "versionType": "git"
            },
            {
              "lessThan": "39079fe8e660851abbafa90cd55cbf029210661f",
              "status": "affected",
              "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.6",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix incorrect mpc_combine array size\n\n[why]\nMAX_SURFACES is per stream, while MAX_PLANES is per asic. The\nmpc_combine is an array that records all the planes per asic. Therefore\nMAX_PLANES should be used as the array size. Using MAX_SURFACES causes\narray overflow when there are more than 3 planes.\n\n[how]\nUse the MAX_PLANES for the mpc_combine array size."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflow is reached only through the local DRM atomic modeset ioctl (`DRM_IOCTL_MODE_ATOMIC`) on /dev/dri/cardN, which drives `amdgpu_dm_atomic_check()` \u2192 `dc_validate_global_state()` \u2192 `dcn32_internal_validate_bw()`. No network or remote data path reaches `dcn32_fpu.c`.\nAC:L - On an affected DCN3.2/3.2.1 ASIC the attacker fully controls the trigger \u2014 assigning four planes (two primaries plus two MPO overlays) across two CRTCs in a single atomic commit, even a TEST_ONLY one, deterministically pushes `mpc_combine_count` past the 3-entry array. No race, no timing window, no unpredictable memory layout is required.\nPR:L - The atomic ioctl requires DRM master, which an ordinary unprivileged user holds for their own graphical session (or obtains by opening the card first on a kiosk/embedded/automotive system with no running compositor); no root or capability in the init namespace is needed.\nUI:N - The attacker performs the entire sequence \u2014 configuring planes and issuing the atomic commit/test \u2014 from their own process; no other user must open a file, plug in hardware, or take any action.\nS:U - The corruption occurs in the kernel stack frame of the amdgpu display driver and stays within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Clobbering `mpc_combine_count` with the low bits of a kernel pointer makes `update_pipes_with_slice_table()` and `update_slice_table_for_plane()` read hundreds of megabytes worth of out-of-bounds indices off the kernel stack and treat that data as `dc_plane_state`/`pipe_ctx` pointers, giving an out-of-bounds read primitive over kernel memory; per kernel CVSS guidance, memory corruption of this class is scored High.\nI:H - This is an out-of-bounds stack write: kernel pointer values are written past the end of `struct pipe_slice_table`, and the corrupted count subsequently allows an append at an attacker-uninfluenced-but-huge index, producing a wild write plus `slice_count += diff` increments at out-of-bounds addresses \u2014 an exploitable memory-corruption primitive.\nA:H - Once the count is corrupted into a multi-million value, the driver dereferences garbage pointers inside a `DC_FP_START()`/kernel_fpu section while holding the DC lock, which reliably produces an oops/panic and takes down the display pipeline."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:28:17.004Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0bd8ef618a42d7e6ea3f701065264e15678025e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/39079fe8e660851abbafa90cd55cbf029210661f"
        }
      ],
      "title": "drm/amd/display: fix incorrect mpc_combine array size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26914",
    "datePublished": "2024-04-17T15:59:24.453Z",
    "dateReserved": "2024-02-19T14:20:24.193Z",
    "dateUpdated": "2026-08-05T11:28:17.004Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26914",
      "date": "2026-09-24",
      "epss": "0.00216",
      "percentile": "0.10673"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix incorrect mpc_combine array size\n\n[why]\nMAX_SURFACES is per stream, while MAX_PLANES is per asic. The\nmpc_combine is an array that records all the planes per asic. Therefore\nMAX_PLANES should be used as the array size. Using MAX_SURFACES causes\narray overflow when there are more than 3 planes.\n\n[how]\nUse the MAX_PLANES for the mpc_combine array size."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: drm/amd/display: corrige el tama\u00f1o incorrecto de la matriz mpc_combine [por qu\u00e9] MAX_SURFACES es por flujo, mientras que MAX_PLANES es por asic. mpc_combine es una matriz que registra todos los planos por asic. Por lo tanto, se debe utilizar MAX_PLANES como tama\u00f1o de matriz. El uso de MAX_SURFACES provoca el desbordamiento de la matriz cuando hay m\u00e1s de 3 planos. [c\u00f3mo] Utilice MAX_PLANES para el tama\u00f1o de matriz mpc_combine."
        }
      ],
      "id": "CVE-2024-26914",
      "lastModified": "2024-11-21T09:03:22.227",
      "published": "2024-04-17T16:15:08.090",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/0bd8ef618a42d7e6ea3f701065264e15678025e3"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/39079fe8e660851abbafa90cd55cbf029210661f"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/0bd8ef618a42d7e6ea3f701065264e15678025e3"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/39079fe8e660851abbafa90cd55cbf029210661f"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T02:19:52.000Z",
      "cve": "CVE-2024-26914",
      "id": "msrc_CVE-2024-26914",
      "initial_release_date": "2025-09-04T02:34:14.000Z",
      "product_status:known_affected": "21",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/amd/display: fix incorrect mpc_combine array size",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-26914.json",
      "version": "19"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0bd8ef618a42d7e6ea3f701065264e15678025e3",
                    "status": "affected",
                    "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "39079fe8e660851abbafa90cd55cbf029210661f",
                    "status": "affected",
                    "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.15"
                  },
                  {
                    "lessThan": "4.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.7.*",
                    "status": "unaffected",
                    "version": "6.7.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.8",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C6D6A5C8-7308-42A9-8A72-ABF3DEA4BB82",
                    "versionEndExcluding": "6.7.6",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "056BD938-0A27-4569-B391-30578B309EE3",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix incorrect mpc_combine array size\n\n[why]\nMAX_SURFACES is per stream, while MAX_PLANES is per asic. The\nmpc_combine is an array that records all the planes per asic. Therefore\nMAX_PLANES should be used as the array size. Using MAX_SURFACES causes\narray overflow when there are more than 3 planes.\n\n[how]\nUse the MAX_PLANES for the mpc_combine array size."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: drm/amd/display: corrige el tama\u00f1o incorrecto de la matriz mpc_combine [por qu\u00e9] MAX_SURFACES es por flujo, mientras que MAX_PLANES es por asic. mpc_combine es una matriz que registra todos los planos por asic. Por lo tanto, se debe utilizar MAX_PLANES como tama\u00f1o de matriz. El uso de MAX_SURFACES provoca el desbordamiento de la matriz cuando hay m\u00e1s de 3 planos. [c\u00f3mo] Utilice MAX_PLANES para el tama\u00f1o de matriz mpc_combine."
          }
        ],
        "id": "CVE-2024-26914",
        "lastModified": "2026-08-04T11:17:20.523",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-26914",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:47:53.436948Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-04-17T16:15:08.090",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0bd8ef618a42d7e6ea3f701065264e15678025e3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/39079fe8e660851abbafa90cd55cbf029210661f"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0bd8ef618a42d7e6ea3f701065264e15678025e3"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/39079fe8e660851abbafa90cd55cbf029210661f"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-129"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:08:49+00:00",
      "cve": "CVE-2024-26914",
      "id": "CVE-2024-26914",
      "initial_release_date": "2024-04-17T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amd/display: fix incorrect mpc_combine array size",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26914.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-22T16:48:10Z",
      "cve": "CVE-2024-26914",
      "id": "CVE-2024-26914",
      "initial_release_date": "2024-04-23T01:44:25Z",
      "product_status:known_not_affected": "313",
      "product_status:recommended": "233",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26914",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26914.json",
      "version": "45"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T00:21:05.456Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/0bd8ef618a42d7e6ea3f701065264e15678025e3"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/39079fe8e660851abbafa90cd55cbf029210661f"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-26914",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T15:47:53.436948Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-11T12:42:13.115Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "0bd8ef618a42d7e6ea3f701065264e15678025e3",
                  "status": "affected",
                  "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
                  "versionType": "git"
                },
                {
                  "lessThan": "39079fe8e660851abbafa90cd55cbf029210661f",
                  "status": "affected",
                  "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.15"
                },
                {
                  "lessThan": "4.15",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.7.*",
                  "status": "unaffected",
                  "version": "6.7.6",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.8",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.7.6",
                      "versionStartIncluding": "4.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.8",
                      "versionStartIncluding": "4.15",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix incorrect mpc_combine array size\n\n[why]\nMAX_SURFACES is per stream, while MAX_PLANES is per asic. The\nmpc_combine is an array that records all the planes per asic. Therefore\nMAX_PLANES should be used as the array size. Using MAX_SURFACES causes\narray overflow when there are more than 3 planes.\n\n[how]\nUse the MAX_PLANES for the mpc_combine array size."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The overflow is reached only through the local DRM atomic modeset ioctl (`DRM_IOCTL_MODE_ATOMIC`) on /dev/dri/cardN, which drives `amdgpu_dm_atomic_check()` \u2192 `dc_validate_global_state()` \u2192 `dcn32_internal_validate_bw()`. No network or remote data path reaches `dcn32_fpu.c`.\nAC:L - On an affected DCN3.2/3.2.1 ASIC the attacker fully controls the trigger \u2014 assigning four planes (two primaries plus two MPO overlays) across two CRTCs in a single atomic commit, even a TEST_ONLY one, deterministically pushes `mpc_combine_count` past the 3-entry array. No race, no timing window, no unpredictable memory layout is required.\nPR:L - The atomic ioctl requires DRM master, which an ordinary unprivileged user holds for their own graphical session (or obtains by opening the card first on a kiosk/embedded/automotive system with no running compositor); no root or capability in the init namespace is needed.\nUI:N - The attacker performs the entire sequence \u2014 configuring planes and issuing the atomic commit/test \u2014 from their own process; no other user must open a file, plug in hardware, or take any action.\nS:U - The corruption occurs in the kernel stack frame of the amdgpu display driver and stays within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Clobbering `mpc_combine_count` with the low bits of a kernel pointer makes `update_pipes_with_slice_table()` and `update_slice_table_for_plane()` read hundreds of megabytes worth of out-of-bounds indices off the kernel stack and treat that data as `dc_plane_state`/`pipe_ctx` pointers, giving an out-of-bounds read primitive over kernel memory; per kernel CVSS guidance, memory corruption of this class is scored High.\nI:H - This is an out-of-bounds stack write: kernel pointer values are written past the end of `struct pipe_slice_table`, and the corrupted count subsequently allows an append at an attacker-uninfluenced-but-huge index, producing a wild write plus `slice_count += diff` increments at out-of-bounds addresses \u2014 an exploitable memory-corruption primitive.\nA:H - Once the count is corrupted into a multi-million value, the driver dereferences garbage pointers inside a `DC_FP_START()`/kernel_fpu section while holding the DC lock, which reliably produces an oops/panic and takes down the display pipeline."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:28:17.004Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/0bd8ef618a42d7e6ea3f701065264e15678025e3"
            },
            {
              "url": "https://git.kernel.org/stable/c/39079fe8e660851abbafa90cd55cbf029210661f"
            }
          ],
          "title": "drm/amd/display: fix incorrect mpc_combine array size",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-26914",
        "datePublished": "2024-04-17T15:59:24.453Z",
        "dateReserved": "2024-02-19T14:20:24.193Z",
        "dateUpdated": "2026-08-05T11:28:17.004Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.