LiveActive security incident?Get immediate response
CVE Record

CVE-2026-45958: drm/exynos: vidi: fix to avoid directly dereferencing user pointer

In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: fix to avoid directly dereferencing user pointer In vidi_connection_ioctl(), vidi->edid(user pointer) is directly dereferenced in the kernel. This allows arbitrary kernel memory access from the user space, so instead of directly accessing the user pointer in the kernel, we should modify it to copy edid to kernel memory using copy_from_user() and use it.

HighCVSS 7.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A local, low-privileged user could abuse the Linux Exynos virtual display driver to make the kernel access attacker-controlled memory. This may expose sensitive kernel data or crash the system. The issue is serious where the affected driver is present and accessible, but it is not remotely exploitable under the supplied CVSS assessment.

Executive priority

Prioritize affected shared, multi-user, appliance, and untrusted-workload systems because an existing local foothold could expose kernel memory or disrupt availability. Validate driver presence before launching broad emergency remediation. Apply vendor-supported fixed kernels promptly; isolated systems without the Exynos VIDI path can follow normal risk-based patching.

Technical view

vidi_connection_ioctl() directly dereferences a user-provided EDID pointer inside the kernel. The published fix copies EDID data into kernel memory with copy_from_user() before use. CVSS 3.1 rates the issue 7.1: local access, low complexity, low privileges, no user interaction, high confidentiality and availability impact, and no stated integrity impact.

Likely exposure

Exposure is most likely on Linux systems using the affected Exynos DRM VIDI functionality and permitting a local user to reach its ioctl interface. The supplied version list is ambiguous and includes commit identifiers and unusual ranges, so kernel-version matching alone is insufficient. Systems without this driver or accessible interface are less likely to be exposed.

Exploitation context

The supplied evidence does not establish active exploitation, public exploit availability, or remote reachability. The CVE is not identified as being in KEV. Exploitation requires local, low-privileged access according to the CVSS vector. Treat claims of privilege escalation cautiously because the published assessment specifies confidentiality and availability impacts, not integrity impact.

Researcher notes

The core defect is unsafe user-pointer handling in vidi_connection_ioctl(). The remediation replaces direct dereferencing with copy_from_user(). The bundle provides eight stable-tree commits, likely covering multiple maintained branches, but does not map each commit to a specific version. No CWE, proof of concept, exploitation telemetry, or vendor-specific package mapping is supplied.

Mitigation direction

  • Update to a vendor-supported kernel containing the applicable stable fix.
  • Confirm the distribution or device vendor's advisory maps the fix to your kernel build.
  • Restrict untrusted local access to the affected device interface where operationally feasible.
  • Prioritize internet-facing multi-user systems only when local footholds or untrusted workloads make the interface reachable.

Validation and detection

  • Inventory running kernels and systems using Exynos DRM VIDI functionality.
  • Compare vendor kernel packages against the published stable fix commits.
  • Verify whether low-privileged users can access the affected driver interface.
  • After updating, confirm the running kernel package includes the applicable backport.
  • Monitor kernel crashes or unusual activity involving the Exynos VIDI driver.
Prepared
Confidence
high
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-45958 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
9Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.1CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.1High
CVSS 3.1 vector shape for CVE-2026-45958Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxb73d12303ecfc91123363d8900e127da44bf42a6, b73d12303ecfc91123363d8900e127da44bf42a6, b73d12303ecfc91123363d8900e127da44bf42a6, b73d12303ecfc91123363d8900e127da44bf42a6, b73d12303ecfc91123363d8900e127da44bf42a6, b73d12303ecfc91123363d8900e127da44bf42a6, b73d12303ecfc91123363d8900e127da44bf42a6, b73d12303ecfc91123363d8900e127da44bf42a6unaffected
LinuxLinux3.4, 0, 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.14, 6.19.4, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.