CVE-2026-53138: drm/amd/display: Bound VBIOS record-chain walk loops
drm/amd/display: Bound VBIOS record-chain walk loops
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.144.1-1 - Configuration
Modify drm/amd/display VBIOS record-chain walk loops in bios_parser.c and bios_parser2.c to cap iterations at BIOS_MAX_NUM_RECORD=256, preventing unbounded for(;;) looping during probe when terminator record is missing.
Linux kernel (drm/amd/display) Cap record-chain walk loops to BIOS_MAX_NUM_RECORD (256) = 256 - Compensating control
Ensure record-chain walk loops in bios_parser.c and bios_parser2.c only iterate while a valid 0xFF record_type sentinel is encountered or the capped BIOS_MAX_NUM_RECORD (256) limit has not been exceeded, rather than relying solely on the terminator record.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53138?
CVE-2026-53138 has a severity rating of 7.1, categorized as high.
What software is affected by CVE-2026-53138?
CVE-2026-53138 affects the Linux kernel, specifically the drm/amd/display component.
How do I fix CVE-2026-53138?
To fix CVE-2026-53138, update to the latest patched version of the Linux kernel.
What are the potential impacts of CVE-2026-53138?
The potential impacts of CVE-2026-53138 include denial of service or system instability due to infinite loops in the VBIOS record-chain.
When was CVE-2026-53138 published?
CVE-2026-53138 was published on June 25, 2026.