CVE-2026-64524 drm/hyperv: validate resolution_count and fix WIN8 fallback
A missing bounds check in the Hyper-V DRM driver allows an out-of-bounds read via crafted resolution counts, potentially causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64524?
CVE-2026-64524 is a high-severity vulnerability in Linux, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/hyperv: validate resolution_count and fix WIN8 fallback
A SYNTHVID_RESOLUTION_RESPONSE with resolution_count > 64 walks past the supported_resolution[SYNTHVID_MAX_RESOLUTION_COUNT] array in the parse loop. Bound resolution_count against the array size, folded into the existing zero-check.
When the WIN10 resolution probe fails, the caller in hyperv_connect_vsp() left hv->screen_*_max / preferred_* unpopulated, which sets mode_config.max_width / max_height to 0 and makes drm_internal_framebuffer_create() reject every userspace framebuffer with -EINVAL. The pre-WIN10 branch had the same gap for preferred_width / preferred_height. Use a single post-probe fallback guarded by screen_width_max == 0 so both paths converge on the WIN8 defaults.
Weakness: CWE-122
Which versions are affected by CVE-2026-64524?
How do I fix CVE-2026-64524?
Apply the vendor's patch.
Is CVE-2026-64524 being exploited?
There is no known exploitation of CVE-2026-64524 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-64524, DEBIAN-CVE-2026-64524, GHSA-2rhv-cg46-xrx8, ROOT-OS-UBUNTU-2204-CVE-2026-64524, UBUNTU-CVE-2026-64524.