CVE-2026-64524

In the Linux kernel, the following vulnerability has been resolved:

drm/hyperv: validate resolution_count and fix WIN8 fallback

A SYNTHVIDRESOLUTIONRESPONSE with resolutioncount > 64 walks past the supportedresolution[SYNTHVIDMAXRESOLUTIONCOUNT] array in the parse loop. Bound resolutioncount against the array size, folded into the existing zero-check.

When the WIN10 resolution probe fails, the caller in hypervconnectvsp() left hv->screen_*max / preferred* unpopulated, which sets modeconfig.maxwidth / maxheight to 0 and makes drminternalframebuffercreate() reject every userspace framebuffer with -EINVAL. The pre-WIN10 branch had the same gap for preferredwidth / preferredheight. Use a single post-probe fallback guarded by screenwidthmax == 0 so both paths converge on the WIN8 defaults.