Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-64524— drm/hyperv: validate resolution_count and fix WIN8 fallback

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于解析SYNTHVID_RESOLUTION_RESPONSE时未正确验证resolution_count导致越界访问，以及WIN10分辨率探测失败时未填充相关字段，可能导致拒绝服务。

CVSS 7.7 · High EPSS 0.14% · P3

Possible ATT&CK Techniques 1 AI

T1211 · Exploitation for Stealth

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux 76c56a5affeba1e163b66b9d8cc192e6154466f0< 96f7de3172d4aa878b7f87173b2b3507c350fcd6 affected
76c56a5affeba1e163b66b9d8cc192e6154466f0< bc573752f3dac0d1ab8df7078c1851bc76717653 affected
76c56a5affeba1e163b66b9d8cc192e6154466f0< 1fb565b77b8f44afabb02de6310065f109d89e94 affected
76c56a5affeba1e163b66b9d8cc192e6154466f0< a321c908f2eeea01539668eb270d074d9b88e490 affected
76c56a5affeba1e163b66b9d8cc192e6154466f0< 9c698b2c43c2667c34f5336bf46ad5786216ac2a affected
76c56a5affeba1e163b66b9d8cc192e6154466f0< 8a114b25b5521eae451b13bce98ae978624962e5 affected
76c56a5affeba1e163b66b9d8cc192e6154466f0< 13d33b9ef67066c77c84273fac5a1d3fde3533d1 affected
5.14 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-64524

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
drm/hyperv: validate resolution_count and fix WIN8 fallback
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate resolution_count and fix WIN8 fallback A SYNTHVID_RESOLUTION_RESPONSE with resolution_count > 64 walks past the supported_resolution[SYNTHVID_MAX_RESOLUTION_COUNT] array in the parse loop. Bound resolution_count against the array size, folded into the existing zero-check. When the WIN10 resolution probe fails, the caller in hyperv_connect_vsp() left hv->screen_*_max / preferred_* unpopulated, which sets mode_config.max_width / max_height to 0 and makes drm_internal_framebuffer_create() reject every userspace framebuffer with -EINVAL. The pre-WIN10 branch had the same gap for preferred_width / preferred_height. Use a single post-probe fallback guarded by screen_width_max == 0 so both paths converge on the WIN8 defaults.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于解析SYNTHVID_RESOLUTION_RESPONSE时未正确验证resolution_count导致越界访问，以及WIN10分辨率探测失败时未填充相关字段，可能导致拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 76c56a5affeba1e163b66b9d8cc192e6154466f0 ~ 96f7de3172d4aa878b7f87173b2b3507c350fcd6 -
Linux Linux 5.14 -

II. Public POCs for CVE-2026-64524

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-64524

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-64524 (6)

Same Patch Batch · Linux · 2026-07-25 · 274 CVEs total

CVE-2026-64397 9.8 CRITICAL ksmbd: serialize QUERY_DIRECTORY requests per file
CVE-2026-64268 9.8 CRITICAL RDMA/siw: bound Read Response placement to the RREAD length
CVE-2026-64384 9.8 CRITICAL smb: client: fix change notify replay double-free
CVE-2026-64383 9.8 CRITICAL smb: client: fix double-free in SMB2_flush() replay
CVE-2026-64385 9.8 CRITICAL smb: client: fix double-free in SMB2_ioctl() replay
CVE-2026-64386 9.8 CRITICAL smb: client: fix query_info() replay double-free
CVE-2026-64387 9.8 CRITICAL smb: client: fix query directory replay double-free
CVE-2026-64391 9.8 CRITICAL ksmbd: use opener credentials for ADS I/O
CVE-2026-64399 9.8 CRITICAL ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
CVE-2026-64355 9.8 CRITICAL bpf: Reject fragmented frames in devmap
CVE-2026-64459 9.8 CRITICAL tcp: restore RCU grace period in tcp_ao_destroy_sock
CVE-2026-64439 9.8 CRITICAL crypto: krb5 - filter out async aead implementations at alloc
CVE-2026-64303 9.8 CRITICAL spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
CVE-2026-64410 9.8 CRITICAL netfilter: flowtable: IPIP tunnel hardware offload is not yet support
CVE-2026-64523 9.8 CRITICAL net/handshake: Take a long-lived file reference at submit
CVE-2026-64319 9.1 CRITICAL nvmet-auth: validate reply message payload bounds against transfer length
CVE-2026-64392 9.1 CRITICAL ksmbd: use opener credentials for delete-on-close
CVE-2026-64450 9.1 CRITICAL tipc: fix out-of-bounds read in broadcast Gap ACK blocks
CVE-2026-64320 9.1 CRITICAL nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
CVE-2026-64393 9.1 CRITICAL ksmbd: run set info with opener credentials

Showing top 20 of 274 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-64524

No comments yet

Leave a comment