{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.187-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.101-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.6-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.101-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  drm/dp/mst: fix buffer overflows in sideband chunk accumulation  drm_dp_sideband_append_payload() has three related bugs when processing device-provided sideband reply data:  1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken    directly from the DP sideband header. If a device sends msg_len=0,    curchunk_len is set to zero. The condition (curchunk_idx \u003e= curchunk_len)    is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow).    drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy()    writes 255 bytes into msg[], both far out of bounds.  2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is    only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks    until curchunk_idx reaches curchunk_len, writing up to 15 bytes past    the end of chunk[] into msg[].  3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to    msg[]. No check ensures curlen + (curchunk_len-1) stays within msg[256],    so the memcpy can spill into adjacent struct fields.  All three are reachable from any DP MST device that can forge sideband reply messages on a physical connection.",
  "id": "DEBIAN-CVE-2026-68278",
  "modified": "2026-09-14T16:47:30.525880866Z",
  "published": "2026-08-10T13:20:16.920Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-68278"
    }
  ],
  "upstream": [
    "CVE-2026-68278"
  ]
}