CVE-2026-53329
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Use krealloc_array() in dal_vector_reserve()
[Why & How]
dal_vector_reserve() computes the allocation size as
"capacity * vector->struct_size" using uint32_t arithmetic, which can
silently wrap to a small value on overflow. This would cause krealloc to
return a smaller buffer than expected, leading to heap overflows on
subsequent vector appends.
Replace krealloc() with krealloc_array() which performs an internal
overflow check and returns NULL on wrap, preventing the issue.
(cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609dd5707)
drm/amd/display: Use krealloc_array() in dal_vector_reserve()
[Why & How]
dal_vector_reserve() computes the allocation size as
"capacity * vector->struct_size" using uint32_t arithmetic, which can
silently wrap to a small value on overflow. This would cause krealloc to
return a smaller buffer than expected, leading to heap overflows on
subsequent vector appends.
Replace krealloc() with krealloc_array() which performs an internal
overflow check and returns NULL on wrap, preventing the issue.
(cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609dd5707)
Vulnerability Details
Published Date
Last Modified
Source
NVD
Vendor
Linux
Product
Linux
External References
- https://git.kernel.org/stable/c/201151e120f0062bcda21cad5d007b82725ad23b
- https://git.kernel.org/stable/c/31180638a33acad12c863132704a76536fb66211
- https://git.kernel.org/stable/c/a914aa802669e073f014dae2e5708633b5cecd34
- https://git.kernel.org/stable/c/b15825deac1acff72638bbc8f05b89ceef8dfb13
- https://git.kernel.org/stable/c/da48bc4461b8a5ebfb9264c9b191a701d8e99009
- https://git.kernel.org/stable/c/de988c7a31f0774f07894cfe4802996f318e2870
- https://git.kernel.org/stable/c/e09689286385a66311ac6922af95339d7a3cef8d
Discussion (0)
Add Comment
No comments yet. Be the first!