CVE-2026-53329

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Use krealloc_array() in dal_vector_reserve() [Why & How] dal_vector_reserve() computes the allocation size as "capacity * vector->struct_size" using uint32_t arithmetic, which can silently wrap to a small value on overflow. This would cause krealloc to return a smaller buffer than expected, leading to heap overflows on subsequent vector appends. Replace krealloc() with krealloc_array() which performs an internal overflow check and returns NULL on wrap, preventing the issue. (cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609dd5707)

CVSS v3 7.0 HIGH

7.0^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.0 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/201151e120f0062bcda21cad5d007b82725ad23b
https://git.kernel.org/stable/c/31180638a33acad12c863132704a76536fb66211
https://git.kernel.org/stable/c/9540b0a4d13e4ede64ae1197d66a176d2149daa9
https://git.kernel.org/stable/c/a914aa802669e073f014dae2e5708633b5cecd34
https://git.kernel.org/stable/c/b15825deac1acff72638bbc8f05b89ceef8dfb13
https://git.kernel.org/stable/c/da48bc4461b8a5ebfb9264c9b191a701d8e99009
https://git.kernel.org/stable/c/de988c7a31f0774f07894cfe4802996f318e2870
https://git.kernel.org/stable/c/e09689286385a66311ac6922af95339d7a3cef8d

Configurations

No configuration.

History

18 Jul 2026, 08:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.0

04 Jul 2026, 12:17

Type	Values Removed	Values Added
References		() https://git.kernel.org/stable/c/9540b0a4d13e4ede64ae1197d66a176d2149daa9 -

01 Jul 2026, 14:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-01 14:16

Updated : 2026-07-18 08:16

NVD link : CVE-2026-53329

Mitre link : CVE-2026-53329

CVE.ORG link : CVE-2026-53329

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-53329", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.0, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.0}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2004f45ef83f07f43f5da6ede780b08068c7583d", "lessThan": "9540b0a4d13e4ede64ae1197d66a176d2149daa9", "versionType": "git"}, {"status": "affected", "version": "2004f45ef83f07f43f5da6ede780b08068c7583d", "lessThan": "31180638a33acad12c863132704a76536fb66211", "versionType": "git"}, {"status": "affected", "version": "2004f45ef83f07f43f5da6ede780b08068c7583d", "lessThan": "b15825deac1acff72638bbc8f05b89ceef8dfb13", "versionType": "git"}, {"status": "affected", "version": "2004f45ef83f07f43f5da6ede780b08068c7583d", "lessThan": "201151e120f0062bcda21cad5d007b82725ad23b", "versionType": "git"}, {"status": "affected", "version": "2004f45ef83f07f43f5da6ede780b08068c7583d", "lessThan": "a914aa802669e073f014dae2e5708633b5cecd34", "versionType": "git"}, {"status": "affected", "version": "2004f45ef83f07f43f5da6ede780b08068c7583d", "lessThan": "e09689286385a66311ac6922af95339d7a3cef8d", "versionType": "git"}, {"status": "affected", "version": "2004f45ef83f07f43f5da6ede780b08068c7583d", "lessThan": "de988c7a31f0774f07894cfe4802996f318e2870", "versionType": "git"}, {"status": "affected", "version": "2004f45ef83f07f43f5da6ede780b08068c7583d", "lessThan": "da48bc4461b8a5ebfb9264c9b191a701d8e99009", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/amd/display/dc/basics/vector.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.15"}, {"status": "unaffected", "version": "0", "lessThan": "4.15", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.260", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.210", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.176", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.143", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.94", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.36", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.13", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/amd/display/dc/basics/vector.c"], "defaultStatus": "affected"}]}], "published": "2026-07-01T14:16:40.760", "references": [{"url": "https://git.kernel.org/stable/c/201151e120f0062bcda21cad5d007b82725ad23b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/31180638a33acad12c863132704a76536fb66211", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9540b0a4d13e4ede64ae1197d66a176d2149daa9", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a914aa802669e073f014dae2e5708633b5cecd34", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b15825deac1acff72638bbc8f05b89ceef8dfb13", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/da48bc4461b8a5ebfb9264c9b191a701d8e99009", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/de988c7a31f0774f07894cfe4802996f318e2870", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e09689286385a66311ac6922af95339d7a3cef8d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Awaiting Analysis", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Use krealloc_array() in dal_vector_reserve()\n\n[Why & How]\ndal_vector_reserve() computes the allocation size as\n\"capacity * vector->struct_size\" using uint32_t arithmetic, which can\nsilently wrap to a small value on overflow. This would cause krealloc to\nreturn a smaller buffer than expected, leading to heap overflows on\nsubsequent vector appends.\n\nReplace krealloc() with krealloc_array() which performs an internal\noverflow check and returns NULL on wrap, preventing the issue.\n\n(cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609dd5707)"}], "lastModified": "2026-07-18T08:16:35.673", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}