GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-64546 (GCVE-0-2026-64546)

Vulnerability from cvelistv5 – Published: 2026-07-27 20:10 – Updated: 2026-08-17 04:57
VLAI
Title
drm/edid: fix OOB read in drm_parse_tiled_block()
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drm_parse_tiled_block() drm_parse_tiled_block() casts the DisplayID block to a struct displayid_tiled_block and reads the full fixed layout up to tile->topology_id[7] without checking block->num_bytes. The DisplayID iterator only validates the declared payload length, so a crafted EDID can advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at the end of a DisplayID extension. The read then runs past the end of the exact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read. Reject blocks shorter than the spec's 22-byte tiled payload before reading the fixed struct, as drm_parse_vesa_mso_data() already does. BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update Read of size 2 at addr ffff888010077700 by task exploit/147 dump_stack_lvl (lib/dump_stack.c:94 ...) print_report (mm/kasan/report.c:378 ...) kasan_report (mm/kasan/report.c:595) drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581) bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574) drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426) status_store (drivers/gpu/drm/drm_sysfs.c:219) ... vfs_write (fs/read_write.c:595 fs/read_write.c:688) ksys_write (fs/read_write.c:740)
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 40d9b043a89e2301e1f97ade055a73ecc28e9afe , < c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0 (git)
Affected: 40d9b043a89e2301e1f97ade055a73ecc28e9afe , < 9acd5c1ddc17ca4c5ffa0c373e3fdf480506e061 (git)
Affected: 40d9b043a89e2301e1f97ade055a73ecc28e9afe , < 157727131ce8a52d8d9bc676c372ef82db6436c4 (git)
Affected: 40d9b043a89e2301e1f97ade055a73ecc28e9afe , < bfa05d89dc3ca3fb1a9099ef5185549a5ec8490d (git)
Affected: 40d9b043a89e2301e1f97ade055a73ecc28e9afe , < 4f5484d25f85ad6c989bad5f6a43450cecfcfd28 (git)
Affected: 40d9b043a89e2301e1f97ade055a73ecc28e9afe , < 9cc0f8e63e8c34cf43def35cbd305ba711181a1f (git)
Affected: 40d9b043a89e2301e1f97ade055a73ecc28e9afe , < 4137e1ecec9c8cb6c4fcee28ffabbbc7409eb7fb (git)
Affected: 40d9b043a89e2301e1f97ade055a73ecc28e9afe , < faaa1e1155833e7d4ce7e3cfaf64c0d636b190db (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.19
Unaffected: 0 , < 3.19 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_edid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0",
              "status": "affected",
              "version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
              "versionType": "git"
            },
            {
              "lessThan": "9acd5c1ddc17ca4c5ffa0c373e3fdf480506e061",
              "status": "affected",
              "version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
              "versionType": "git"
            },
            {
              "lessThan": "157727131ce8a52d8d9bc676c372ef82db6436c4",
              "status": "affected",
              "version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
              "versionType": "git"
            },
            {
              "lessThan": "bfa05d89dc3ca3fb1a9099ef5185549a5ec8490d",
              "status": "affected",
              "version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
              "versionType": "git"
            },
            {
              "lessThan": "4f5484d25f85ad6c989bad5f6a43450cecfcfd28",
              "status": "affected",
              "version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
              "versionType": "git"
            },
            {
              "lessThan": "9cc0f8e63e8c34cf43def35cbd305ba711181a1f",
              "status": "affected",
              "version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
              "versionType": "git"
            },
            {
              "lessThan": "4137e1ecec9c8cb6c4fcee28ffabbbc7409eb7fb",
              "status": "affected",
              "version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
              "versionType": "git"
            },
            {
              "lessThan": "faaa1e1155833e7d4ce7e3cfaf64c0d636b190db",
              "status": "affected",
              "version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_edid.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.19"
            },
            {
              "lessThan": "3.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/edid: fix OOB read in drm_parse_tiled_block()\n\ndrm_parse_tiled_block() casts the DisplayID block to a\nstruct displayid_tiled_block and reads the full fixed layout up to\ntile-\u003etopology_id[7] without checking block-\u003enum_bytes. The DisplayID\niterator only validates the declared payload length, so a crafted EDID\ncan advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or\nDATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at\nthe end of a DisplayID extension. The read then runs past the end of the\nexact-sized kmemdup()\u0027d EDID allocation, a heap out-of-bounds read.\n\nReject blocks shorter than the spec\u0027s 22-byte tiled payload before\nreading the fixed struct, as drm_parse_vesa_mso_data() already does.\n\n  BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update\n  Read of size 2 at addr ffff888010077700 by task exploit/147\n   dump_stack_lvl (lib/dump_stack.c:94 ...)\n   print_report (mm/kasan/report.c:378 ...)\n   kasan_report (mm/kasan/report.c:595)\n   drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581)\n   bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574)\n   drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426)\n   status_store (drivers/gpu/drm/drm_sysfs.c:219)\n   ...\n   vfs_write (fs/read_write.c:595 fs/read_write.c:688)\n   ksys_write (fs/read_write.c:740)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The crafted EDID reaches the parser through a local device node \u2014 an unprivileged DRM client supplying a raw EDID buffer via the exynos vidi `DRM_AUTH` ioctl, or root via the connector\u0027s debugfs `edid_override` plus a sysfs re-probe. No network path exists, and local ioctl delivery is the lowest-friction vector (a physically attached malicious monitor/dock is an additional, equally automatic route).\nAC:L - The attacker fully controls the EDID bytes and only needs to place a tiled-display DisplayID block with a small `num_bytes` at the tail of the last extension block; `drm_edid_valid()` checks nothing but the header and checksums, which the attacker computes. No race and no memory-layout precondition is needed to trigger the read.\nPR:L - Handing an arbitrary EDID to `drm_edid_connector_update()` via `DRM_IOCTL_EXYNOS_VIDI_CONNECTION` requires only an authenticated DRM client (`DRM_AUTH`), i.e. an ordinary logged-in user with access to /dev/dri \u2014 no CAP_SYS_ADMIN and no root.\nUI:N - The attacker drives the connector probe itself through the ioctl, and on the hotplug path the EDID is read and parsed automatically by the kernel. No victim action is involved.\nS:U - The out-of-bounds read stays within the kernel\u0027s own heap and the impact is confined to the kernel security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Up to ~21 bytes of adjacent slab memory are read past the exact-size EDID allocation, and eight of those bytes are persisted into the connector\u0027s tile fields and handed back to userspace in the TILE property blob via `DRM_IOCTL_MODE_GETPROPBLOB`, giving a repeatable heap-content leak usable to defeat KASLR or recover neighbouring object data.\nI:N - The defect is purely a read; `drm_mode_create_tile_group()` copies the OOB source into a properly sized destination, so no out-of-bounds write or control-flow corruption occurs.\nA:H - The read runs past the end of the slab object and, for exact-fit allocations at a slab boundary, can touch unmapped memory; on KASAN or panic_on_warn kernels it is an immediate fatal report, and the resulting garbage tile geometry is propagated to the modesetting path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:57:23.260Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/9acd5c1ddc17ca4c5ffa0c373e3fdf480506e061"
        },
        {
          "url": "https://git.kernel.org/stable/c/157727131ce8a52d8d9bc676c372ef82db6436c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfa05d89dc3ca3fb1a9099ef5185549a5ec8490d"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f5484d25f85ad6c989bad5f6a43450cecfcfd28"
        },
        {
          "url": "https://git.kernel.org/stable/c/9cc0f8e63e8c34cf43def35cbd305ba711181a1f"
        },
        {
          "url": "https://git.kernel.org/stable/c/4137e1ecec9c8cb6c4fcee28ffabbbc7409eb7fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/faaa1e1155833e7d4ce7e3cfaf64c0d636b190db"
        }
      ],
      "title": "drm/edid: fix OOB read in drm_parse_tiled_block()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64546",
    "datePublished": "2026-07-27T20:10:37.217Z",
    "dateReserved": "2026-07-19T15:36:31.795Z",
    "dateUpdated": "2026-08-17T04:57:23.260Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64546",
      "date": "2026-09-20",
      "epss": "0.00126",
      "percentile": "0.0262"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/drm_edid.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0",
                    "status": "affected",
                    "version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9acd5c1ddc17ca4c5ffa0c373e3fdf480506e061",
                    "status": "affected",
                    "version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "157727131ce8a52d8d9bc676c372ef82db6436c4",
                    "status": "affected",
                    "version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bfa05d89dc3ca3fb1a9099ef5185549a5ec8490d",
                    "status": "affected",
                    "version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4f5484d25f85ad6c989bad5f6a43450cecfcfd28",
                    "status": "affected",
                    "version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9cc0f8e63e8c34cf43def35cbd305ba711181a1f",
                    "status": "affected",
                    "version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4137e1ecec9c8cb6c4fcee28ffabbbc7409eb7fb",
                    "status": "affected",
                    "version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "faaa1e1155833e7d4ce7e3cfaf64c0d636b190db",
                    "status": "affected",
                    "version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/drm_edid.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.19"
                  },
                  {
                    "lessThan": "3.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/edid: fix OOB read in drm_parse_tiled_block()\n\ndrm_parse_tiled_block() casts the DisplayID block to a\nstruct displayid_tiled_block and reads the full fixed layout up to\ntile-\u003etopology_id[7] without checking block-\u003enum_bytes. The DisplayID\niterator only validates the declared payload length, so a crafted EDID\ncan advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or\nDATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at\nthe end of a DisplayID extension. The read then runs past the end of the\nexact-sized kmemdup()\u0027d EDID allocation, a heap out-of-bounds read.\n\nReject blocks shorter than the spec\u0027s 22-byte tiled payload before\nreading the fixed struct, as drm_parse_vesa_mso_data() already does.\n\n  BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update\n  Read of size 2 at addr ffff888010077700 by task exploit/147\n   dump_stack_lvl (lib/dump_stack.c:94 ...)\n   print_report (mm/kasan/report.c:378 ...)\n   kasan_report (mm/kasan/report.c:595)\n   drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581)\n   bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574)\n   drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426)\n   status_store (drivers/gpu/drm/drm_sysfs.c:219)\n   ...\n   vfs_write (fs/read_write.c:595 fs/read_write.c:688)\n   ksys_write (fs/read_write.c:740)"
          }
        ],
        "id": "CVE-2026-64546",
        "lastModified": "2026-08-17T05:17:59.813",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-27T21:17:07.270",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/157727131ce8a52d8d9bc676c372ef82db6436c4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4137e1ecec9c8cb6c4fcee28ffabbbc7409eb7fb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4f5484d25f85ad6c989bad5f6a43450cecfcfd28"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9acd5c1ddc17ca4c5ffa0c373e3fdf480506e061"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9cc0f8e63e8c34cf43def35cbd305ba711181a1f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bfa05d89dc3ca3fb1a9099ef5185549a5ec8490d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/faaa1e1155833e7d4ce7e3cfaf64c0d636b190db"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:28:34+00:00",
      "cve": "CVE-2026-64546",
      "id": "CVE-2026-64546",
      "initial_release_date": "2026-07-27T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/edid: fix OOB read in drm_parse_tiled_block()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64546.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:38:31Z",
      "cve": "CVE-2026-64546",
      "id": "CVE-2026-64546",
      "initial_release_date": "2026-07-28T17:07:59Z",
      "product_status:known_affected": "671",
      "product_status:known_not_affected": "62",
      "product_status:recommended": "111",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64546",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64546.json",
      "version": "12"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.