Medium [CVE-2026-68277] fix OOB reads on 2-byte fields in sideband reply parsers

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Three sideband reply parsers read 16-bit fields as: val = (raw->msg[idx] msg[idx+1]); and check bounds only after the fact.

When idx == raw->curlen, raw->msg[idx+1] reads one byte past the received message data into the following struct fields (curchunk_len, curchunk_idx, curlen).

Affected functions: - drm_dp_sideband_parse_enum_path_resources_ack() full_payload_bw_number and avail_payload_bw_number fields - drm_dp_sideband_parse_allocate_payload_ack() allocated_pbn field - drm_dp_sideband_parse_query_payload_ack() allocated_pbn field Fix by using a single combined check (idx + 2 > curlen) before each 2-byte read.

Since the check is strictly tighter than idx > curlen, no separate step is needed. [added fixes tag] A flaw was found in the Linux kernel's `drm/dp/mst` (Direct Rendering Manager/DisplayPort/Multi-Stream Transport) sideband reply parsers.

This out-of-bounds read vulnerability occurs when processing 2-byte fields in sideband replies, where the system attempts to read beyond the allocated buffer. A local attacker could potentially exploit this to read sensitive information from adjacent memory locations, leading to information disclosure.