CVE-2026-53135

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs [Why & How] dp_sdp_message_debugfs_write() dereferences connector->base.state->crtc without checking for NULL. A connector can be connected but not bound to any CRTC (e.g. after hot-plug before the next atomic commit), causing a kernel crash when writing to the sdp_message debugfs node. The function also ignores the user-provided size argument and always passes 36 bytes to copy_from_user(), reading past the user buffer when size < 36. Fix both issues by: - Returning -ENODEV when connector->base.state or state->crtc is NULL - Clamping write_size to min(size, sizeof(data)) (cherry picked from commit 6ab4c36a522842ff70474a1c0af2e40e50fc8300)

EPSS — Exploit Prediction

0.0018

Probability of exploitation

0.07%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/7ae95c0275c330b5dbae806f8e431720edad776f https://git.kernel.org/stable/c/7fc4fab4acc307ad2903312c195872b2953d32c3 https://git.kernel.org/stable/c/a2de1d71891a038a9346b2c1a72b88c8350f2479 https://git.kernel.org/stable/c/adf67034b1f61f7119295208085bfd43f85f56af https://git.kernel.org/stable/c/b781f90a9528555c709e59789550893581ef0be4 https://git.kernel.org/stable/c/bb6f705b73b5f191f14ad004e2c8c4b615806187 https://git.kernel.org/stable/c/c90954cdea4d6998ec345de0d840d030c145b89e https://git.kernel.org/stable/c/ee9cfcf77a8e8af637396dc00966df5f701e661c

Frequently Asked Questions

What is CVE-2026-53135? +

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs [Why & How] dp_sdp_message_debugfs_write() dereferences connector->base.state->crtc without checking for NULL. A connector can be connected but not bound to any CRTC (e.g. after hot-plug before the next atomic commit), causing a kernel crash when writing to the sdp_message debugfs node. The function also ignores the user-provided size argument and always passes 36 bytes to copy_from_user(), reading past the user buffer when size < 36. Fix both issues by: - Returning -ENODEV when connector->base.state or state->crtc is NULL - Clamping write_size to min(size, sizeof(data)) (cherry picked from commit 6ab4c36a522842ff70474a1c0af2e40e50fc8300)

How do I check if I'm vulnerable to CVE-2026-53135? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Description

EPSS — Exploit Prediction

References

Other References

Frequently Asked Questions

Don't wait for an exploit