CVE-2026-53136: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
[Why & How] The VBIOS integrated info tables (v111 and v21) contain HdmiRegNum and Hdmi6GRegNum fields that are used as loop bounds when copying retimer I2C register settings into fixed-size arrays (dpexthdmiregsettings[9] and dpexthdmi6gregsettings[3]). These u8 fields are not validated before use, so a malformed VBIOS can specify values up to 255, causing an out-of-bounds heap write during driver probe.
Clamp each register count to the destination array size using mint() before the copy loops, in both getintegratedinfov11() and getintegratedinfov21().
(cherry picked from commit 5a7f0ef90195940c54b0f5bb85b87da55f038c69)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53136?
CVE-2026-53136 has a high severity rating of 7.8.
How do I fix CVE-2026-53136?
To fix CVE-2026-53136, update your Linux kernel to the latest version where the vulnerability has been resolved.
What software is affected by CVE-2026-53136?
CVE-2026-53136 affects the Linux kernel, particularly the drm/amd/display component.
What is the risk associated with CVE-2026-53136?
CVE-2026-53136 poses a risk level of 69, indicating significant potential for impact.
What type of vulnerability is CVE-2026-53136?
CVE-2026-53136 is a vulnerability related to clamping the VBIOS HDMI retimer register count to the array size.