CVE-2026-64524: drm/hyperv: validate resolution_count and fix WIN8 fallback
In the Linux kernel, the following vulnerability has been resolved:
drm/hyperv: validate resolutioncount and fix WIN8 fallback
A SYNTHVIDRESOLUTIONRESPONSE with resolutioncount > 64 walks past the supportedresolution[SYNTHVIDMAXRESOLUTIONCOUNT] array in the parse loop. Bound resolutioncount against the array size, folded into the existing zero-check.
When the WIN10 resolution probe fails, the caller in hypervconnectvsp() left hv->screenmax / preferred unpopulated, which sets modeconfig.maxwidth / maxheight to 0 and makes drminternalframebuffercreate() reject every userspace framebuffer with -EINVAL. The pre-WIN10 branch had the same gap for preferredwidth / preferredheight. Use a single post-probe fallback guarded by screenwidthmax == 0 so both paths converge on the WIN8 defaults.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64524?
CVE-2026-64524 has a risk rating of 23, indicating a significant vulnerability in the Linux kernel.
How do I fix CVE-2026-64524?
To fix CVE-2026-64524, upgrade the Linux kernel to the latest version where the vulnerability has been addressed.
What component of the Linux kernel is affected by CVE-2026-64524?
CVE-2026-64524 affects the drm/hyperv component of the Linux kernel.
What specific issue does CVE-2026-64524 address?
CVE-2026-64524 addresses the validation of resolution_count in SYNTHVID_RESOLUTION_RESPONSE to prevent out-of-bounds access.
When was CVE-2026-64524 published?
CVE-2026-64524 was published on July 25, 2026.