CVE-2026-68255 drm/virtio: bound EDID block reads to the response buffer
A malicious virtio-gpu backend can trigger an out-of-bounds read in the Linux kernel, leaking adjacent kernel memory into parsed EDID data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68255?
CVE-2026-68255 is a high-severity vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: bound EDID block reads to the response buffer
virtio_get_edid_block() validates the read offset only against the device-supplied resp->size field, never against the fixed-size resp->edid array. The EDID block index is driven by the device-supplied extension count, so a malicious virtio-gpu backend can advertise a large size together with a high block count and read far past the array into adjacent kernel memory, which is then surfaced in the parsed EDID (an out-of-bounds read / info leak).
Also reject any read whose end exceeds the size of the edid array. Conforming EDID responses stay within the array and are unaffected.
Weakness: CWE-125
Which versions are affected by CVE-2026-68255?
How do I fix CVE-2026-68255?
Apply the vendor's patch.
Is CVE-2026-68255 being exploited?
There is no known exploitation of CVE-2026-68255 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68255, DEBIAN-CVE-2026-68255, GHSA-ww5r-hf7r-8fmv, UBUNTU-CVE-2026-68255.