CVE-2026-53329drm/amd/display: Use krealloc_array() in dal_vector_reserve()
- 7.0HighCVSS base score
- 0.15%Exploitation in 30 daysEPSS · top 96% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Use krealloc_array() in dal_vector_reserve() [Why & How] dal_vector_reserve() computes the allocation size as "capacity * vector->struct_size" using uint32_t arithmetic, which can silently wrap to a small value on overflow. This would cause krealloc to return a smaller buffer than expected, leading to heap overflows on subsequent vector appends. Replace krealloc() with krealloc_array() which performs an internal overflow check and returns NULL on wrap, preventing the issue. (cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609dd5707)
Timeline
ID reserved
By Linux
- 22 days later
· 22 days later
Published
- 4 months later
· 4 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.15% · top 96% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.0.
Affected products
- affected 2004f45ef83f07f43f5da6ede780b08068c7583d – < 9540b0a4d13e4ede64ae1197d66a176d2149daa9
- affected 2004f45ef83f07f43f5da6ede780b08068c7583d – < 31180638a33acad12c863132704a76536fb66211
- affected 2004f45ef83f07f43f5da6ede780b08068c7583d – < b15825deac1acff72638bbc8f05b89ceef8dfb13
- affected 2004f45ef83f07f43f5da6ede780b08068c7583d – < 201151e120f0062bcda21cad5d007b82725ad23b
- affected 2004f45ef83f07f43f5da6ede780b08068c7583d – < a914aa802669e073f014dae2e5708633b5cecd34
- affected 2004f45ef83f07f43f5da6ede780b08068c7583d – < e09689286385a66311ac6922af95339d7a3cef8d
- affected 2004f45ef83f07f43f5da6ede780b08068c7583d – < de988c7a31f0774f07894cfe4802996f318e2870
- affected 2004f45ef83f07f43f5da6ede780b08068c7583d – < da48bc4461b8a5ebfb9264c9b191a701d8e99009
- affected 4.15
- unaffected < 4.15
- unaffected 5.10.260 – ≤ 5.10.*
- unaffected 5.15.210 – ≤ 5.15.*
- unaffected 6.1.176 – ≤ 6.1.*
- unaffected 6.6.143 – ≤ 6.6.*
- unaffected 6.12.94 – ≤ 6.12.*
- unaffected 6.18.36 – ≤ 6.18.*
- unaffected 7.0.13 – ≤ 7.0.*
- unaffected 7.1 – ≤ *
References
References8
- https://git.kernel.org/stable/c/9540b0a4d13e4ede64ae1197d66a176d2149daa9 (opens in a new tab)
- https://git.kernel.org/stable/c/31180638a33acad12c863132704a76536fb66211 (opens in a new tab)
- https://git.kernel.org/stable/c/b15825deac1acff72638bbc8f05b89ceef8dfb13 (opens in a new tab)
- https://git.kernel.org/stable/c/201151e120f0062bcda21cad5d007b82725ad23b (opens in a new tab)
- https://git.kernel.org/stable/c/a914aa802669e073f014dae2e5708633b5cecd34 (opens in a new tab)
- https://git.kernel.org/stable/c/e09689286385a66311ac6922af95339d7a3cef8d (opens in a new tab)
- https://git.kernel.org/stable/c/de988c7a31f0774f07894cfe4802996f318e2870 (opens in a new tab)
- https://git.kernel.org/stable/c/da48bc4461b8a5ebfb9264c9b191a701d8e99009 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-40963 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-53329)Record last updated .