Medium [CVE-2026-68279] Linux kernel: Out-of-bounds read in DP MST sideband reply parsers

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers drm_dp_sideband_parse_remote_dpcd_read() reads num_bytes from the raw message and then unconditionally does: memcpy(bytes, &raw->msg[idx], num_bytes); without checking that idx + num_bytes curlen. raw->msg[] is 256 bytes; if a malicious or misbehaving MST hub sets num_bytes larger than the remaining payload, the memcpy reads past the received data into whatever follows in raw->msg[]. drm_dp_sideband_parse_remote_i2c_read_ack() has the same flaw (noted with a /* TODO check */ comment since the code was introduced).

Fix both functions by using a single combined check (idx + num_bytes > curlen) before each memcpy. Since num_bytes is u8, it is always >= 0, so this strictly subsumes the simpler idx > curlen form and no separate step is needed. [added missing fixes tag] A flaw was found in the Linux kernel's DisplayPort (DP) Multi-Stream Transport (MST) subsystem.

A malicious or misbehaving MST hub could send a specially crafted sideband message that causes an out-of-bounds read in the `drm_dp_sideband_parse_remote_dpcd_read()` and `drm_dp_sideband_parse_remote_i2c_read_ack()` functions.

This vulnerability allows the system to read past the intended data, potentially leading to information disclosure or system instability.