CVE-2026-68278

In the Linux kernel, the following vulnerability has been resolved:

drm/dp/mst: fix buffer overflows in sideband chunk accumulation

drmdpsidebandappendpayload() has three related bugs when processing device-provided sideband reply data:

1. Zero-length curchunklen underflow: msglen is a 6-bit field taken directly from the DP sideband header. If a device sends msglen=0, curchunklen is set to zero. The condition (curchunkidx >= curchunklen) is immediately true, and curchunklen-1 wraps to 255 (u8 underflow). drmdpmsgdata_crc4() reads 255 bytes from chunk[48], then memcpy() writes 255 bytes into msg[], both far out of bounds.

2. chunk[48] overflow: curchunklen can reach 63 (6-bit field). chunk[] is only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks until curchunkidx reaches curchunk_len, writing up to 15 bytes past the end of chunk[] into msg[].

3. msg[256] overflow: each chunk contributes (curchunklen-1) bytes to msg[]. No check ensures curlen + (curchunklen-1) stays within msg[256], so the memcpy can spill into adjacent struct fields.

All three are reachable from any DP MST device that can forge sideband reply messages on a physical connection.