In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Use krealloc_array() in dal_vector_reserve()

[Why & How]
dal_vector_reserve() computes the allocation size as
"capacity * vector->struct_size" using uint32_t arithmetic, which can
silently wrap to a small value on overflow. This would cause krealloc to
return a smaller buffer than expected, leading to heap overflows on
subsequent vector appends.

Replace krealloc() with krealloc_array() which performs an internal
overflow check and returns NULL on wrap, preventing the issue.

(cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609dd5707)

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
2004f45ef83f07f43f5da6ede780b08068c7583d affected < 31180638a33acad12c863132704a76536fb66211
2004f45ef83f07f43f5da6ede780b08068c7583d affected < b15825deac1acff72638bbc8f05b89ceef8dfb13
2004f45ef83f07f43f5da6ede780b08068c7583d affected < 201151e120f0062bcda21cad5d007b82725ad23b
2004f45ef83f07f43f5da6ede780b08068c7583d affected < a914aa802669e073f014dae2e5708633b5cecd34
2004f45ef83f07f43f5da6ede780b08068c7583d affected < e09689286385a66311ac6922af95339d7a3cef8d
2004f45ef83f07f43f5da6ede780b08068c7583d affected < de988c7a31f0774f07894cfe4802996f318e2870
2004f45ef83f07f43f5da6ede780b08068c7583d affected < da48bc4461b8a5ebfb9264c9b191a701d8e99009
Linux Linux affected
Version Status Constraints
4.15 affected —
0 unaffected < 4.15
5.15.210 unaffected ≤ 5.15.*
6.1.176 unaffected ≤ 6.1.*
6.6.143 unaffected ≤ 6.6.*
6.12.94 unaffected ≤ 6.12.*
6.18.36 unaffected ≤ 6.18.*
7.0.13 unaffected ≤ 7.0.*
7.1 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/201151e120f0062bcda21cad5d007b82725ad23b cve-icon
https://git.kernel.org/stable/c/31180638a33acad12c863132704a76536fb66211 cve-icon
https://git.kernel.org/stable/c/a914aa802669e073f014dae2e5708633b5cecd34 cve-icon
https://git.kernel.org/stable/c/b15825deac1acff72638bbc8f05b89ceef8dfb13 cve-icon
https://git.kernel.org/stable/c/da48bc4461b8a5ebfb9264c9b191a701d8e99009 cve-icon
https://git.kernel.org/stable/c/de988c7a31f0774f07894cfe4802996f318e2870 cve-icon
https://git.kernel.org/stable/c/e09689286385a66311ac6922af95339d7a3cef8d cve-icon
History

Wed, 01 Jul 2026 17:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-122
CWE-680

Wed, 01 Jul 2026 13:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Use krealloc_array() in dal_vector_reserve() [Why & How] dal_vector_reserve() computes the allocation size as "capacity * vector->struct_size" using uint32_t arithmetic, which can silently wrap to a small value on overflow. This would cause krealloc to return a smaller buffer than expected, leading to heap overflows on subsequent vector appends. Replace krealloc() with krealloc_array() which performs an internal overflow check and returns NULL on wrap, preventing the issue. (cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609dd5707)
Title drm/amd/display: Use krealloc_array() in dal_vector_reserve()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-01T13:32:14.598Z

Reserved: 2026-06-09T07:44:35.398Z

Link: CVE-2026-53329

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-01T17:00:05Z

Weaknesses