{ "cveId": "CVE-2026-46263", "url": "https://patchblox.com/security/cve/CVE-2026-46263", "summary": "CVE-2026-46263 is fixed in 16 products on 1 platform, first by DEBIAN-CVE-2026-46263, released June 24, 2026. It is not reported as exploited. Patch Radar priority: High.", "title": "linux: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bounds stream encode...", "description": "In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bounds stream encoder index v3 eng_id can be negative and that stream_enc_regs[] can be indexed out of bounds. eng_id is used directly as an index into stream_enc_regs[], which has only 5 entries. When eng_id is 5 (ENGINE_ID_DIGF) or negative, this can access memory past the end of the array. Add a bounds check using ARRAY_SIZE() before using eng_id as an index. The unsigned cast also rejects negative values. This avoids out-of-bounds access. Fixes the below smatch error: dcn*_resource.c: stream_encoder_create() may index stream_enc_regs[eng_id] out of bounds (size 5). drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn351/dcn351_resource.c 1246 static struct stream_encoder *dcn35_stream_encoder_create( 1247 enum engine_id eng_id, 1248 struct dc_context *ctx) 1249 { ... 1255 1256 /* Mapping of VPG, AFMT, DME register blocks to DIO block instance */ 1257 if (eng_id \u003C= ENGINE_ID_DIGF) { ENGINE_ID_DIGF is 5. should \u003C= be \u003C? Unrelated but, ugh, why is Smatch saying that \u0022eng_id\u0022 can be negative? end_id is type signed long, but there are checks in the caller which prevent it from being negative. 1258 vpg_inst = eng_id; 1259 afmt_inst = eng_id; 1260 } else 1261 return NULL; 1262 ... 1281 1282 dcn35_dio_stream_encoder_construct(enc1, ctx, ctx-\u003Edc_bios, 1283 eng_id, vpg, afmt, --\u003E 1284 \u0026stream_enc_regs[eng_id], ^^^^^^^^^^^^^^^^^^^^^^^ This stream_enc_regs[] array has 5 elements so we are one element beyond the end of the array. ... 1287 return \u0026enc1-\u003Ebase; 1288 } v2: use explicit bounds check as suggested by Roman/Dan; avoid unsigned int cast v3: The compiler already knows how to compare the two values, so the cast (int) is not needed. (Roman)", "published": "2026-06-03T18:16:27Z", "severity": "high", "cvss": 7.8, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "epss": 0.0012, "epssPercentile": 0.01854, "priority": "High", "priorityTier": 3, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "dtb-aarch64", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.37.1", "fix": "OPENSUSE-SU-2026:21555-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1", "released": "2026-08-12T01:09:28Z" }, { "platform": "linux", "product": "kernel-64kb", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.37.1", "fix": "OPENSUSE-SU-2026:21555-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1", "released": "2026-08-12T01:09:28Z" }, { "platform": "linux", "product": "kernel-64kb", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.73.2", "fix": "SUSE-SU-2026:3166-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3166-1", "released": "2026-07-21T17:09:27Z" }, { "platform": "linux", "product": "kernel-64kb", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.37.1", "fix": "SUSE-SU-2026:23231-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1", "released": "2026-08-11T21:26:34Z" }, { "platform": "linux", "product": "kernel-azure", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.37.1", "fix": "OPENSUSE-SU-2026:21555-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1", "released": "2026-08-12T01:09:28Z" }, { "platform": "linux", "product": "kernel-azure", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.73.2", "fix": "SUSE-SU-2026:3166-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3166-1", "released": "2026-07-21T17:09:27Z" }, { "platform": "linux", "product": "kernel-azure", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.37.1", "fix": "SUSE-SU-2026:23231-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1", "released": "2026-08-11T21:26:34Z" }, { "platform": "linux", "product": "kernel-default", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.37.1", "fix": "OPENSUSE-SU-2026:21555-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1", "released": "2026-08-12T01:09:28Z" }, { "platform": "linux", "product": "kernel-default", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.73.2", "fix": "SUSE-SU-2026:3166-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3166-1", "released": "2026-07-21T17:09:27Z" }, { "platform": "linux", "product": "kernel-default", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.37.1", "fix": "SUSE-SU-2026:23237-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23237-1", "released": "2026-08-11T21:34:22Z" }, { "platform": "linux", "product": "kernel-default-base", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.37.1.160000.2.19", "fix": "OPENSUSE-SU-2026:21555-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1", "released": "2026-08-12T01:09:28Z" }, { "platform": "linux", "product": "kernel-default-base", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.73.2.150700.17.41.4", "fix": "SUSE-SU-2026:3166-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3166-1", "released": "2026-07-21T17:09:27Z" }, { "platform": "linux", "product": "kernel-default-base", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.37.1.160000.2.19", "fix": "SUSE-SU-2026:23231-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1", "released": "2026-08-11T21:26:34Z" }, { "platform": "linux", "product": "kernel-docs", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.37.1", "fix": "OPENSUSE-SU-2026:21555-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1", "released": "2026-08-12T01:09:28Z" }, { "platform": "linux", "product": "kernel-docs", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.73.1", "fix": "SUSE-SU-2026:3166-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3166-1", "released": "2026-07-21T17:09:27Z" }, { "platform": "linux", "product": "kernel-docs", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.37.1", "fix": "SUSE-SU-2026:23231-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1", "released": "2026-08-11T21:26:34Z" }, { "platform": "linux", "product": "kernel-kvmsmall", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.37.1", "fix": "OPENSUSE-SU-2026:21555-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1", "released": "2026-08-12T01:09:28Z" }, { "platform": "linux", "product": "kernel-kvmsmall", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.37.1", "fix": "SUSE-SU-2026:23231-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1", "released": "2026-08-11T21:26:34Z" }, { "platform": "linux", "product": "kernel-livepatch-SLE15-SP7-RT_Update_18", "release": "sles 15.7", "fixedVersion": "1-150700.1.5.1", "fix": "SUSE-SU-2026:3130-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3130-1", "released": "2026-07-20T12:25:31Z" }, { "platform": "linux", "product": "kernel-livepatch-SLE15-SP7_Update_19", "release": "sles 15.7", "fixedVersion": "1-150700.15.3.4", "fix": "SUSE-SU-2026:3166-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3166-1", "released": "2026-07-21T17:09:27Z" }, { "platform": "linux", "product": "kernel-obs-build", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.37.1", "fix": "OPENSUSE-SU-2026:21555-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1", "released": "2026-08-12T01:09:28Z" }, { "platform": "linux", "product": "kernel-obs-build", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.73.2", "fix": "SUSE-SU-2026:3166-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3166-1", "released": "2026-07-21T17:09:27Z" }, { "platform": "linux", "product": "kernel-obs-qa", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.37.1", "fix": "OPENSUSE-SU-2026:21555-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1", "released": "2026-08-12T01:09:28Z" }, { "platform": "linux", "product": "kernel-obs-qa", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.37.1", "fix": "SUSE-SU-2026:23231-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1", "released": "2026-08-11T21:26:34Z" }, { "platform": "linux", "product": "kernel-rt", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.37.1", "fix": "OPENSUSE-SU-2026:21555-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1", "released": "2026-08-12T01:09:28Z" }, { "platform": "linux", "product": "kernel-source", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.37.1", "fix": "OPENSUSE-SU-2026:21555-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1", "released": "2026-08-12T01:09:28Z" }, { "platform": "linux", "product": "kernel-source", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.73.1", "fix": "SUSE-SU-2026:3166-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3166-1", "released": "2026-07-21T17:09:27Z" }, { "platform": "linux", "product": "kernel-source", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.37.1", "fix": "SUSE-SU-2026:23231-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1", "released": "2026-08-11T21:26:34Z" }, { "platform": "linux", "product": "kernel-syms", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.37.1", "fix": "OPENSUSE-SU-2026:21555-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1", "released": "2026-08-12T01:09:28Z" }, { "platform": "linux", "product": "kernel-syms", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.73.1", "fix": "SUSE-SU-2026:3166-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3166-1", "released": "2026-07-21T17:09:27Z" }, { "platform": "linux", "product": "kernel-syms", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.37.1", "fix": "SUSE-SU-2026:23231-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1", "released": "2026-08-11T21:26:34Z" }, { "platform": "linux", "product": "kernel-zfcpdump", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.37.1", "fix": "OPENSUSE-SU-2026:21555-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21555-1", "released": "2026-08-12T01:09:28Z" }, { "platform": "linux", "product": "kernel-zfcpdump", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.73.2", "fix": "SUSE-SU-2026:3166-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3166-1", "released": "2026-07-21T17:09:27Z" }, { "platform": "linux", "product": "kernel-zfcpdump", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.37.1", "fix": "SUSE-SU-2026:23231-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23231-1", "released": "2026-08-11T21:26:34Z" }, { "platform": "linux", "product": "linux", "release": "Debian 13.5 (trixie)", "fixedVersion": "6.12.85-1", "fix": "DEBIAN-CVE-2026-46263", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-46263", "released": "2026-06-24T14:07:24Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "6.18.14-1", "fix": "DEBIAN-CVE-2026-46263", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-46263", "released": "2026-06-24T14:07:24Z" } ], "noFixYet": [], "dataAsOf": "2026-11-08T00:53:09Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }