PT-2024-21577 · Linux+2 · Linux Kernel+2

Greg Kroah-Hartman + 1 · Published 2024-01-18 · Updated 2026-03-14 · CVE-2024-26914

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the drm/amd/display component of the Linux kernel, where the mpc combine array size was incorrectly set to MAX SURFACES instead of MAX PLANES. This causes an array overflow when there are more than 3 planes. The mpc combine array records all the planes per asic, and using MAX SURFACES as the array size leads to this overflow.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

ALSA-2025_12746

ALSA-2025_12752

ALSA-2025_12753

ALSA-2025_16880

ALT-PU-2025-12647

AZL-62803

BDU:2026-03296

CVE-2024-26914

ECHO-A7C3-8351-0CBE

SUSE-SU-2025:20028-1

Affected Products

Alt Linux

Debian

Linux Kernel

References · 1833

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26914.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-26914 · Security Note
• https://osv.dev/vulnerability/AZL-62803 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2024-26914 · Vendor Advisory
• https://git.kernel.org/stable/c/0bd8ef618a42d7e6ea3f701065264e15678025e3 · Patch
• https://bdu.fstec.ru/vul/2026-03296 · Security Note
• https://git.kernel.org/stable/c/39079fe8e660851abbafa90cd55cbf029210661f · Patch
• https://security-tracker.debian.org/tracker/CVE-2024-26914 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-26914 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-26914 · Security Note
• https://ubuntu.com/security/CVE-2024-26914 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-26914 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2024-26914 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:20028-1 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2024-26914 · Vendor Advisory