Linux: Out-of-bounds Read
CVE-2026-46263 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 29f3824b08a98d41ecbbfd33580630d7607f962e, 263e28add4f4472cfa95150d218955d1945aa413, ca3808d560ad946ab6d089fd1f5bee04b952ead4 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.12% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 29f3824b08a98d41ecbbfd33580630d7607f962e or 263e28add4f4472cfa95150d218955d1945aa413 or ca3808d560ad946ab6d089fd1f5bee04b952ead4 or abde491143e4e12eecc41337910aace4e8d59603, whichever matches your release line, or a later version.
- Update Linux Kernel to 6.12.75 or 6.18.14 or 6.19.4, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 2728e9c7c84235d2d7bc1403174d071ffc82d6d2 up to, but not including, 29f3824b08a98d41ecbbfd33580630d7607f962e; 2728e9c7c84235d2d7bc1403174d071ffc82d6d2 up to, but not including, 263e28add4f4472cfa95150d218955d1945aa413; 2728e9c7c84235d2d7bc1403174d071ffc82d6d2 up to, but not including, ca3808d560ad946ab6d089fd1f5bee04b952ead4; 2728e9c7c84235d2d7bc1403174d071ffc82d6d2 up to, but not including, abde491143e4e12eecc41337910aace4e8d59603; 6.9 | 29f3824b08a98d41ecbbfd33580630d7607f962e, 263e28add4f4472cfa95150d218955d1945aa413, ca3808d560ad946ab6d089fd1f5bee04b952ead4, abde491143e4e12eecc41337910aace4e8d59603 |
| Linux | Linux Kernel | 6.9 up to, but not including, 6.12.75; 6.13 up to, but not including, 6.18.14; 6.19 up to, but not including, 6.19.4 | 6.12.75, 6.18.14, 6.19.4 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bounds stream encoder index v3 eng_id can be negative and that stream_enc_regs[] can be indexed out of bounds. eng_id is used directly as an index into stream_enc_regs[], which has only 5 entries. When eng_id is 5 (ENGINE_ID_DIGF) or negative, this can access memory past the end of the array. Add a bounds check using ARRAY_SIZE() before using eng_id as an index. The unsigned cast also rejects negative values. This avoids out-of-bounds access. Fixes the below smatch error: dcn*_resource.c: stream_encoder_create() may index stream_enc_regs[eng_id] out of bounds (size 5). drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn351/dcn351_resource.c 1246 static struct stream_encoder *dcn35_stream_encoder_create( 1247 enum engine_id eng_id, 1248 struct dc_context *ctx) 1249 { ... 1255 1256 /* Mapping of VPG, AFMT, DME register blocks to DIO block instance */ 1257 if (eng_id <= ENGINE_ID_DIGF) { ENGINE_ID_DIGF is 5. should <= be <? Unrelated but, ugh, why is Smatch saying that "eng_id" can be negative? end_id is type signed long, but there are checks in the caller which prevent it from being negative. 1258 vpg_inst = eng_id; 1259 afmt_inst = eng_id; 1260 } else 1261 return NULL; 1262 ... 1281 1282 dcn35_dio_stream_encoder_construct(enc1, ctx, ctx->dc_bios, 1283 eng_id, vpg, afmt, --> 1284 &stream_enc_regs[eng_id], ^^^^^^^^^^^^^^^^^^^^^^^ This stream_enc_regs[] array has 5 elements so we are one element beyond the end of the array. ... 1287 return &enc1->base; 1288 } v2: use explicit bounds check as suggested by Roman/Dan; avoid unsigned int cast v3: The compiler already knows how to compare the two values, so the cast (int) is not needed. (Roman)
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
How developers prevent this class of flaw
- Use a language that provides appropriate memory abstractions.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
Recent Out-of-bounds Read vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 8.1 High severity
- 7.8 High severity
- 7.8 High severity
- 8.3 High severity
Spotted an error? Tell us.