CVE-2026-53135 - Vulnerability Details

- drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs

[Why & How]
dp_sdp_message_debugfs_write() dereferences connector->base.state->crtc
without checking for NULL. A connector can be connected but not bound to
any CRTC (e.g. after hot-plug before the next atomic commit), causing a
kernel crash when writing to the sdp_message debugfs node.

The function also ignores the user-provided size argument and always
passes 36 bytes to copy_from_user(), reading past the user buffer when
size < 36.

Fix both issues by:
- Returning -ENODEV when connector->base.state or state->crtc is NULL
- Clamping write_size to min(size, sizeof(data))

(cherry picked from commit 6ab4c36a522842ff70474a1c0af2e40e50fc8300)

Published: 2026-06-25

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c7ba3653e9773256b2b08508a2ed2ca28ea7566b`	affected	< ee9cfcf77a8e8af637396dc00966df5f701e661c
`c7ba3653e9773256b2b08508a2ed2ca28ea7566b`	affected	< b781f90a9528555c709e59789550893581ef0be4
`c7ba3653e9773256b2b08508a2ed2ca28ea7566b`	affected	< a2de1d71891a038a9346b2c1a72b88c8350f2479
`c7ba3653e9773256b2b08508a2ed2ca28ea7566b`	affected	< 7fc4fab4acc307ad2903312c195872b2953d32c3
`c7ba3653e9773256b2b08508a2ed2ca28ea7566b`	affected	< 7ae95c0275c330b5dbae806f8e431720edad776f
`c7ba3653e9773256b2b08508a2ed2ca28ea7566b`	affected	< bb6f705b73b5f191f14ad004e2c8c4b615806187
`c7ba3653e9773256b2b08508a2ed2ca28ea7566b`	affected	< c90954cdea4d6998ec345de0d840d030c145b89e
`c7ba3653e9773256b2b08508a2ed2ca28ea7566b`	affected	< adf67034b1f61f7119295208085bfd43f85f56af

Linux

affected

Version	Status	Constraints
`5.2`	affected	—
`0`	unaffected	< 5.2
`5.10.259`	unaffected	≤ 5.10.*
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.94`	unaffected	≤ 6.12.*
`6.18.36`	unaffected	≤ 6.18.*
`7.0.13`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[c7ba3653e9773256b2b08508a2ed2ca28ea7566b,ee9cfcf77a8e8af637396dc00966df5f701e661c)`	affected	code_commit	—
`[c7ba3653e9773256b2b08508a2ed2ca28ea7566b,b781f90a9528555c709e59789550893581ef0be4)`	affected	code_commit	—
`[c7ba3653e9773256b2b08508a2ed2ca28ea7566b,a2de1d71891a038a9346b2c1a72b88c8350f2479)`	affected	code_commit	—
`[c7ba3653e9773256b2b08508a2ed2ca28ea7566b,7fc4fab4acc307ad2903312c195872b2953d32c3)`	affected	code_commit	—
`[c7ba3653e9773256b2b08508a2ed2ca28ea7566b,7ae95c0275c330b5dbae806f8e431720edad776f)`	affected	code_commit	—
`[c7ba3653e9773256b2b08508a2ed2ca28ea7566b,bb6f705b73b5f191f14ad004e2c8c4b615806187)`	affected	code_commit	—
`[c7ba3653e9773256b2b08508a2ed2ca28ea7566b,c90954cdea4d6998ec345de0d840d030c145b89e)`	affected	code_commit	—
`[c7ba3653e9773256b2b08508a2ed2ca28ea7566b,adf67034b1f61f7119295208085bfd43f85f56af)`	affected	code_commit	—
`5.2`	affected	semver	—
`[0,5.2)`	unaffected	semver	—
`[5.10.259,5.11.0)`	unaffected	semver	—
`[5.15.210,5.16.0)`	unaffected	semver	—
`[6.1.176,6.2.0)`	unaffected	semver	—
`[6.6.143,6.7.0)`	unaffected	semver	—
`[6.12.94,6.13.0)`	unaffected	semver	—
`[6.18.36,6.19.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00176.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/7ae95c0275c330b5dbae806f8e431720edad776f
https://git.kernel.org/stable/c/7fc4fab4acc307ad2903312c195872b2953d32c3
https://git.kernel.org/stable/c/a2de1d71891a038a9346b2c1a72b88c8350f2479
https://git.kernel.org/stable/c/adf67034b1f61f7119295208085bfd43f85f56af
https://git.kernel.org/stable/c/b781f90a9528555c709e59789550893581ef0be4
https://git.kernel.org/stable/c/bb6f705b73b5f191f14ad004e2c8c4b615806187
https://git.kernel.org/stable/c/c90954cdea4d6998ec345de0d840d030c145b89e
https://git.kernel.org/stable/c/ee9cfcf77a8e8af637396dc00966df5f701e661c
https://lore.kernel.org/linux-cve-announce/2026062542-CVE-2026-53135-2c56@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53135
https://www.cve.org/CVERecord?id=CVE-2026-53135

History

Fri, 26 Jun 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026062542-CVE-2026-53135-2c56@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53135 https://www.cve.org/CVERecord?id=CVE-2026-53135

Thu, 25 Jun 2026 11:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476 CWE-787

Thu, 25 Jun 2026 09:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs [Why & How] dp_sdp_message_debugfs_write() dereferences connector->base.state->crtc without checking for NULL. A connector can be connected but not bound to any CRTC (e.g. after hot-plug before the next atomic commit), causing a kernel crash when writing to the sdp_message debugfs node. The function also ignores the user-provided size argument and always passes 36 bytes to copy_from_user(), reading past the user buffer when size < 36. Fix both issues by: - Returning -ENODEV when connector->base.state or state->crtc is NULL - Clamping write_size to min(size, sizeof(data)) (cherry picked from commit 6ab4c36a522842ff70474a1c0af2e40e50fc8300)
Title		drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/7ae95c0275c330b5dbae806f8e431720edad776f https://git.kernel.org/stable/c/7fc4fab4acc307ad2903312c195872b2953d32c3 https://git.kernel.org/stable/c/a2de1d71891a038a9346b2c1a72b88c8350f2479 https://git.kernel.org/stable/c/adf67034b1f61f7119295208085bfd43f85f56af https://git.kernel.org/stable/c/b781f90a9528555c709e59789550893581ef0be4 https://git.kernel.org/stable/c/bb6f705b73b5f191f14ad004e2c8c4b615806187 https://git.kernel.org/stable/c/c90954cdea4d6998ec345de0d840d030c145b89e https://git.kernel.org/stable/c/ee9cfcf77a8e8af637396dc00966df5f701e661c

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-25T08:38:24.216Z

Updated: 2026-06-25T08:38:24.216Z

Reserved: 2026-06-09T07:44:35.387Z

Link: CVE-2026-53135

Vulnrichment

No data.

NVD

No data.

Redhat

Severity :

Publid Date: 2026-06-25T00:00:00Z

Links: CVE-2026-53135 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-25T16:15:15Z

Weaknesses

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object