{"id":"CVE-2026-53137","summary":"drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size\n\n[Why & How]\nDuring HDCP 2.x repeater authentication over HDMI, the driver reads the\nsink's RxStatus register and extracts a 10-bit message size field (max\nvalue 1023). This value is used as the read length for the ReceiverID\nlist without being clamped to the size of the destination buffer\nrx_id_list[177]. A malicious HDMI repeater could advertise a message\nsize larger than the buffer, causing an out-of-bounds write during the\nI2C read.\n\nClamp the read length in mod_hdcp_read_rx_id_list() to the size of the\nrx_id_list buffer, matching the approach already used in the DP branch.\n\n(cherry picked from commit 229212219e4247d9486f8ba41ef087358490be09)","modified":"2026-07-09T18:29:54.489908177Z","published":"2026-06-25T08:38:25.977Z","related":["CGA-xpmq-r4v3-hwxm"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53137.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/1906064d50d194a145486e5caf3db3e708b6f6ef"},{"type":"WEB","url":"https://git.kernel.org/stable/c/3c4444aec06c74fbc05661f370954ac814963c38"},{"type":"WEB","url":"https://git.kernel.org/stable/c/79e0273272a05fb26f9b1e55bf1a52eefc3b7b35"},{"type":"WEB","url":"https://git.kernel.org/stable/c/91fb41218c413989d8b6c837748751454b452d68"},{"type":"WEB","url":"https://git.kernel.org/stable/c/964e50ef7b8f09815a7d05b8326af700f8d5bc96"},{"type":"WEB","url":"https://git.kernel.org/stable/c/98cfb7530ea91d8e5e928285cdce58e1131f6e83"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bfba882cfcd08f6540f72f48e786b6404f5d2c5b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f0f3981c43b32cadfe373d636d9e9ca522bb3702"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53137.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53137"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"eff682f83c9c2030761e7536c5d97e1b20f71c15"},{"fixed":"3c4444aec06c74fbc05661f370954ac814963c38"},{"fixed":"91fb41218c413989d8b6c837748751454b452d68"},{"fixed":"964e50ef7b8f09815a7d05b8326af700f8d5bc96"},{"fixed":"79e0273272a05fb26f9b1e55bf1a52eefc3b7b35"},{"fixed":"bfba882cfcd08f6540f72f48e786b6404f5d2c5b"},{"fixed":"1906064d50d194a145486e5caf3db3e708b6f6ef"},{"fixed":"98cfb7530ea91d8e5e928285cdce58e1131f6e83"},{"fixed":"f0f3981c43b32cadfe373d636d9e9ca522bb3702"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53137.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.0"},{"fixed":"5.10.259"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.210"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.176"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.143"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.94"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.36"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.0.13"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53137.json"}}],"schema_version":"1.7.5"}