HIGH
amdgpu HDCPArray OOB
CVE-2026-90289
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Resize MST HDCP per-connector arrays to 32 AMDGPU_DM_MAX_DISPLAY_INDEX is 31. It suggest a maximum number of 32 connectors. But the way it's used is like MAX_DISPLAY_COUNT. Hence we're off by one with DRM core, which supports a max of 32 connectors. Rename AMDGPU_DM_MAX_DISPLAY_INDEX to AMDGPU_DM_MAX_DISPLAY_COUNT to match its actual use, and increase the size to 32 to match the originally intended size.
02KernelScan AI Analysis
Risk summary
The AMD GPU display driver's HDCP per-connector arrays are sized one element too small (31 instead of 32), while the DRM core supports up to 32 connectors. On a system with 32 active connectors—achievable via MST daisy-chaining—accessing the 32nd connector writes past the array boundary, corrupting adjacent fields in the HDCP workqueue structure. This is a local attack requiring specific AMD GPU hardware and an unusual multi-display configuration.
Vulnerability analysis
The AMD GPU driver's HDCP tracking arrays are sized for 31 connectors, but the system can create up to 32. When the 32nd connector is active, driver state updates write past the end of these arrays, corrupting adjacent memory that holds other HDCP data. This only occurs on AMD systems with enough MST-connected displays to reach 32 active connectors. The fix enlarges all affected arrays to hold 32 entries so every valid connector has a dedicated slot. An attacker needs local access to a machine with the required AMD hardware and either physical access to connect enough displays or a pre-existing large MST topology.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 5.15.128 | 5.16 | decea8279bec |
| 6.1 | 6.1.47 | 6.2 | ac490fea9fe7 |
| 6.12 | — | 6.12.114 | 0fa116a17b69 |
| 6.18 | — | 6.18.57 | 261e0fe4e2c9 |
| 6.6 | — | 6.6.160 | 562d24ac214b |
| 7.2 | — | 7.2.6 | — |
| mainline | — | 7.3 | — |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Affected — no CIP fix yet (latest 6.12.112-cip33) |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.189-cip61) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |