CyberSecBulletin
CVE-2026-64546NVD status: Analyzed

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-64546 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0, 9acd5c1ddc17ca4c5ffa0c373e3fdf480506e061, 157727131ce8a52d8d9bc676c372ef82db6436c4 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.13% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0 or 9acd5c1ddc17ca4c5ffa0c373e3fdf480506e061 or 157727131ce8a52d8d9bc676c372ef82db6436c4 or bfa05d89dc3ca3fb1a9099ef5185549a5ec8490d, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.261 or 5.15.212 or 6.1.178 or 6.6.145, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux40d9b043a89e2301e1f97ade055a73ecc28e9afe up to, but not including, c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0; 40d9b043a89e2301e1f97ade055a73ecc28e9afe up to, but not including, 9acd5c1ddc17ca4c5ffa0c373e3fdf480506e061; 40d9b043a89e2301e1f97ade055a73ecc28e9afe up to, but not including, 157727131ce8a52d8d9bc676c372ef82db6436c4; 40d9b043a89e2301e1f97ade055a73ecc28e9afe up to, but not including, bfa05d89dc3ca3fb1a9099ef5185549a5ec8490d; 40d9b043a89e2301e1f97ade055a73ecc28e9afe up to, but not including, 4f5484d25f85ad6c989bad5f6a43450cecfcfd28; 40d9b043a89e2301e1f97ade055a73ecc28e9afe up to, but not including, 9cc0f8e63e8c34cf43def35cbd305ba711181a1f; 40d9b043a89e2301e1f97ade055a73ecc28e9afe up to, but not including, 4137e1ecec9c8cb6c4fcee28ffabbbc7409eb7fb; 40d9b043a89e2301e1f97ade055a73ecc28e9afe up to, but not including, faaa1e1155833e7d4ce7e3cfaf64c0d636b190db; and 1 more rangesc4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0, 9acd5c1ddc17ca4c5ffa0c373e3fdf480506e061, 157727131ce8a52d8d9bc676c372ef82db6436c4, bfa05d89dc3ca3fb1a9099ef5185549a5ec8490d, 4f5484d25f85ad6c989bad5f6a43450cecfcfd28, 9cc0f8e63e8c34cf43def35cbd305ba711181a1f
LinuxLinux Kernel3.19 up to, but not including, 5.10.261; 5.11 up to, but not including, 5.15.212; 5.16 up to, but not including, 6.1.178; 6.2 up to, but not including, 6.6.145; 6.7 up to, but not including, 6.12.97; 6.13 up to, but not including, 6.18.40; 6.19 up to, but not including, 7.1.55.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drm_parse_tiled_block() drm_parse_tiled_block() casts the DisplayID block to a struct displayid_tiled_block and reads the full fixed layout up to tile->topology_id[7] without checking block->num_bytes. The DisplayID iterator only validates the declared payload length, so a crafted EDID can advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at the end of a DisplayID extension. The read then runs past the end of the exact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read. Reject blocks shorter than the spec's 22-byte tiled payload before reading the fixed struct, as drm_parse_vesa_mso_data() already does. BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update Read of size 2 at addr ffff888010077700 by task exploit/147 dump_stack_lvl (lib/dump_stack.c:94 ...) print_report (mm/kasan/report.c:378 ...) kasan_report (mm/kasan/report.c:595) drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581) bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574) drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426) status_store (drivers/gpu/drm/drm_sysfs.c:219) ... vfs_write (fs/read_write.c:595 fs/read_write.c:688) ksys_write (fs/read_write.c:740)

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.