{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-45958", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.088Z", "datePublished": "2026-05-27T12:18:14.878Z", "dateUpdated": "2026-08-05T12:28:56.396Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:28:56.396Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/exynos: vidi: fix to avoid directly dereferencing user pointer\n\nIn vidi_connection_ioctl(), vidi->edid(user pointer) is directly\ndereferenced in the kernel.\n\nThis allows arbitrary kernel memory access from the user space, so instead\nof directly accessing the user pointer in the kernel, we should modify it\nto copy edid to kernel memory using copy_from_user() and use it." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached through the EXYNOS_VIDI_CONNECTION DRM ioctl on the local primary device node (/dev/dri/cardN); it requires local system access, not network or adjacent reachability.\nAC:L - The attacker fully controls the vidi->edid pointer value passed in the ioctl and can reliably trigger the dereference/copy on demand; no race or uncontrolled condition is involved.\nPR:L - The ioctl is flagged DRM_AUTH, so the caller must be an authenticated DRM client (a local user with access to the DRM device node, who can become master on first open); no elevated/root privileges are needed.\nUI:N - The attacker issues the ioctl and reads back the connector EDID property entirely on their own; no action by another user is required.\nS:U - The impact stays within the kernel's own security authority; no crossing of a VM, IOMMU, or sandbox boundary occurs.\nC:H - The user-supplied value is dereferenced as a kernel pointer and up to 32 KB is kmemdup'd from any attacker-chosen kernel address, then exposed back to userspace via the connector's EDID blob property — an arbitrary kernel-memory read/info-leak primitive.\nI:N - The flaw copies data from the attacker-controlled address into a freshly allocated kernel buffer; it provides no primitive to write or modify attacker-controlled kernel memory.\nA:H - Supplying an unmapped or invalid kernel address causes the direct dereference/kmemdup to fault, producing a kernel oops/panic and denial of service." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/exynos/exynos_drm_vidi.c" ], "versions": [ { "version": "b73d12303ecfc91123363d8900e127da44bf42a6", "lessThan": "13537f7f6d28a87ee2e496e071b6ad9541905f23", "status": "affected", "versionType": "git" }, { "version": "b73d12303ecfc91123363d8900e127da44bf42a6", "lessThan": "c2914c0ca7557c6c5c845621cb6d6c9f26ab5a8c", "status": "affected", "versionType": "git" }, { "version": "b73d12303ecfc91123363d8900e127da44bf42a6", "lessThan": "7efb6a4e6b1b523e744d17e6249757ed97caae7c", "status": "affected", "versionType": "git" }, { "version": "b73d12303ecfc91123363d8900e127da44bf42a6", "lessThan": "2e147aa3169b83eaf044776f81d86235bf147de1", "status": "affected", "versionType": "git" }, { "version": "b73d12303ecfc91123363d8900e127da44bf42a6", "lessThan": "4c4193829109f38b2855de77981adc2e066286c7", "status": "affected", "versionType": "git" }, { "version": "b73d12303ecfc91123363d8900e127da44bf42a6", "lessThan": "4949e32387fe315b59ad5f422c9fc52836fbdd1e", "status": "affected", "versionType": "git" }, { "version": "b73d12303ecfc91123363d8900e127da44bf42a6", "lessThan": "235d702b771416b8a61e81bb09ba39282e4268fd", "status": "affected", "versionType": "git" }, { "version": "b73d12303ecfc91123363d8900e127da44bf42a6", "lessThan": "d4c98c077c7fb2dfdece7d605e694b5ea2665085", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/exynos/exynos_drm_vidi.c" ], "versions": [ { "version": "3.4", "status": "affected" }, { "version": "0", "lessThan": "3.4", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.167", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.130", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.77", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.14", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.4", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.4", "versionEndExcluding": "5.10.253" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.4", "versionEndExcluding": "5.15.203" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.4", "versionEndExcluding": "6.1.167" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.4", "versionEndExcluding": "6.6.130" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.4", "versionEndExcluding": "6.12.77" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.4", "versionEndExcluding": "6.18.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.4", "versionEndExcluding": "6.19.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.4", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/13537f7f6d28a87ee2e496e071b6ad9541905f23" }, { "url": "https://git.kernel.org/stable/c/c2914c0ca7557c6c5c845621cb6d6c9f26ab5a8c" }, { "url": "https://git.kernel.org/stable/c/7efb6a4e6b1b523e744d17e6249757ed97caae7c" }, { "url": "https://git.kernel.org/stable/c/2e147aa3169b83eaf044776f81d86235bf147de1" }, { "url": "https://git.kernel.org/stable/c/4c4193829109f38b2855de77981adc2e066286c7" }, { "url": "https://git.kernel.org/stable/c/4949e32387fe315b59ad5f422c9fc52836fbdd1e" }, { "url": "https://git.kernel.org/stable/c/235d702b771416b8a61e81bb09ba39282e4268fd" }, { "url": "https://git.kernel.org/stable/c/d4c98c077c7fb2dfdece7d605e694b5ea2665085" } ], "title": "drm/exynos: vidi: fix to avoid directly dereferencing user pointer", "x_generator": { "engine": "bippy-1.2.0" } } } }