CVE-2026-68277: Patch Linux Kernel DisplayPort MST OOB Read

The National Vulnerability Database published the record on August 10, 2026, drawing its description and affected-code information from kernel.org. The underlying patch, posted to the Linux DRM development list by Intel engineer Ashutosh Desai in April, was subsequently included in the DRM pull request for Linux 7.2-rc1. Its backports have now landed in five maintained kernel lines: 6.6.148, 6.12.101, 6.18.42, 7.1.6, and the Linux 7.2 release-candidate series.

The key point missing from the short CVE synopsis is that this is a device-supplied message parsing flaw, not a vulnerability an ordinary desktop application can reach through a local API. A malformed reply has to arrive through the DisplayPort MST control path. That narrows the attack surface substantially, but it also puts the boundary at a hardware-adjacent protocol layer, where a malicious, compromised, or simply defective dock or hub can provide the data the kernel trusts too far.

Three parsers read before proving two bytes exist​

The vulnerable code sits in

, the DRM display-helper implementation that manages a DisplayPort MST topology. MST is the DisplayPort feature that allows a single physical link to carry multiple display streams, commonly through a dock, monitor hub, or daisy-chain arrangement.

Three sideband-reply parsing functions had the same ordering mistake. Each assembled a 16-bit value from two message bytes:

Only after that read did the code increase

by two and verify whether the parser had crossed the received message length. In other words, the parser verified that the read was valid after it had performed it.

The affected replies are not arbitrary metadata. They carry payload-bandwidth information used while the system queries and allocates DisplayPort MST transport resources:

• drm_dp_sideband_parse_enum_path_resources_ack() reads the full and available payload bandwidth values.
• drm_dp_sideband_parse_allocate_payload_ack() reads the allocated payload bandwidth number, or PBN.
• drm_dp_sideband_parse_query_payload_ack() reads the allocated PBN returned by a query.

When the parser reaches the end of a truncated sideband reply, the second byte of the 16-bit field can come from beyond the received message. The CVE record specifically identifies adjacent fields including

,

, and

.

That detail changes how this bug should be understood. The reported defect is an out-of-bounds read relative to the received message, and the cited adjacent fields indicate that the read can expose or incorporate parser bookkeeping data rather than necessarily stepping immediately into an unrelated allocation. It is still invalid kernel behavior and still a security bug, but the public record does not establish arbitrary kernel-memory disclosure, privilege escalation, or code execution.

No CVSS score has been assigned by NVD as of August 11, 2026, and neither the NVD record nor the kernel patch identifies a public exploit, a reproducible system crash, or a confirmed impact beyond the invalid reads. Administrators should resist turning the absence of a score into a claim that the issue is harmless; it means the public severity assessment has not been completed.

The patch is small, but it fixes a real trust-boundary error​

Desai’s patch replaces the late check with a single validation immediately before every two-byte field is consumed:

if (idx + 2 > raw->curlen)
    goto fail_len;

That check requires both bytes to be inside the received payload before the code dereferences either one. It also eliminates redundant checks after the read, because a successful pre-check proves that advancing the cursor by two cannot exceed

.

The change modifies 17 lines in one file: seven insertions and 10 deletions. Small patches can look routine in distribution changelogs, but the fix addresses a common and consequential parser bug pattern: checking the cursor position instead of checking the full width of the pending read.

Checking

is enough before consuming a one-byte field. It is insufficient for a two-byte field at the end of a buffer. At

, one byte remains, but two are required. At

, no bytes remain. The replacement test handles both cases before data is read.

The patch was one of two DisplayPort MST out-of-bounds-read corrections submitted together by Desai. The May DRM pull request described the work broadly as fixes for “OOB reads related to DP-MST” and listed this exact parser patch separately from a second fix for Remote DPCD and I2C sideband reply parsers. They are related cleanup work in the same protocol area, but they are distinct bugs. CVE-2026-68277 covers the three two-byte fields described above; it should not be treated as a catch-all identifier for every MST parsing correction merged in that series.

The affected-version data is clearer than it first appears​

The kernel.org CVE data says the vulnerable code dates back to Linux 3.17, which is when the relevant MST support entered the kernel. That does not mean every Linux system running a version number between 3.17 and 7.2 is currently exposed in the same way: vendors routinely backport security patches while retaining an older-looking base version.

Kernel.org’s fixed points are the useful anchors:

The record’s Git version data also shows that the fix was backported to each of those maintained branches rather than merely appearing in mainline. That is important for organizations with long-lived fleet kernels: the remediation is available without a forced jump to a new major kernel line.

For distribution users, however, the upstream number is only a starting point. Red Hat Enterprise Linux, Ubuntu LTS, Debian stable, SUSE, Oracle Linux, Amazon Linux, Proxmox, and appliance vendors may ship a backported patch under a package version that does not resemble any number in the table. The right verification method is the vendor’s security advisory or changelog for the installed kernel package, looking for CVE-2026-68277 or the DRM DP MST parser fix.

A machine can also be outside the immediate exposure path despite running affected source code. Systems using only HDMI, DisplayPort single-stream transport, or no external display hardware do not exercise the MST sideband-reply handling at issue. Conversely, systems with USB-C docks, multi-monitor DP hubs, DisplayPort daisy chains, KVMs that emulate or proxy display devices, and lab hardware that repeatedly attaches unknown peripherals have the most credible reason to prioritize the update.

Windows hosts are not the main target​

For WindowsForum readers, this CVE is not a Windows kernel vulnerability. The affected component is Linux DRM code, not Microsoft’s Windows display stack, and the public records do not identify Windows as an affected product.

It is also unlikely to be a meaningful direct exposure for ordinary WSL 2 use. WSL 2 normally presents graphics through its virtualized environment and WSLg integration rather than allowing a Linux guest to directly enumerate and manage a host’s physical DisplayPort MST topology. A Windows laptop connected to an MST dock does not become exposed merely because WSL is installed.

The place to pay attention is mixed infrastructure: Linux workstations, developer laptops dual-booting Linux, Linux VDI or remote-workstation images with physical GPU passthrough, build systems that boot a full Linux kernel on test hardware, and managed endpoints attached to USB-C docking fleets. In those environments, the issue belongs in normal kernel patch management rather than in a Windows endpoint emergency response plan.

Update the kernel, then verify the running image​

The operational response is straightforward. Install the distribution’s kernel update, reboot where the platform requires it, and confirm the host is actually using the patched kernel rather than merely storing the updated package on disk.

For directly managed upstream-style systems, the fixed releases are Linux 6.6.148, 6.12.101, 6.18.42, 7.1.6, or Linux 7.2-rc1 and later. For enterprise distributions, verify the package’s vendor advisory instead of comparing only

against upstream version numbers.

There is no published mitigation that is as reliable as patching. Disconnecting untrusted MST docks or avoiding daisy-chained displays can reduce exposure before an update window, but it is a temporary risk-control measure and may be impractical for users who depend on docking hardware.

CVE-2026-68277 is a narrowly scoped kernel parser correction with no public evidence of exploitation or a confirmed high-impact outcome. Its real administrative lesson is more mundane and more useful: when a kernel driver parses device-originated protocol data, “we check the length later” is not a defense. The fixed kernels now make the check at the only point it can protect—the moment before the two bytes are read.