{"id":"CVE-2024-49970","title":"drm/amd/display: Implement bounds check for stream encoder creation in DCN401","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Implement bounds check for stream encoder creation in DCN401\n\n'stream_enc_regs' array is an array of dcn10_stream_enc_registers\nstructures. The array i…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c < 00872dcc2a3e4a42155c2f3b7f21952a62301035","Linux >= 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c < b219b46ad42df1dea9258788bcfea37181f3ccb2","Linux >= 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c < bdf606810210e8e07a0cdf1af3c467291363b295","Linux 4.15"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-10-22T13:33:55.440679Z"},"published":"2024-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:35:26.675Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-49970","references":[{"url":"https://git.kernel.org/stable/c/00872dcc2a3e4a42155c2f3b7f21952a62301035"},{"url":"https://git.kernel.org/stable/c/b219b46ad42df1dea9258788bcfea37181f3ccb2"},{"url":"https://git.kernel.org/stable/c/bdf606810210e8e07a0cdf1af3c467291363b295"}],"tags":["cve.org"],"epss":0.00295,"epssPercentile":0.21993,"ingestedAt":"2026-10-21T12:48:53.727Z","slug":"CVE-2024-49970","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Implement bounds check for stream encoder creation in DCN401\n\n'stream_enc_regs' array is an array of dcn10_stream_enc_registers\nstructures. The array is initialized with four elements, corresponding\nto the four calls to stream_enc_regs() in the array initializer. This\nmeans that valid indices for this array are 0, 1, 2, and 3.\n\nThe error message 'stream_enc_regs' 4 <= 5 below, is indicating that\nthere is an attempt to access this array with an index of 5, which is\nout of bounds. This could lead to undefined behavior\n\nHere, eng_id is used as an index to access the stream_enc_regs array. If\neng_id is 5, this would result in an out-of-bounds access on the\nstream_enc_regs array.\n\nThus fixing Buffer overflow error in dcn401_stream_encoder_create\n\nFound by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn401/dcn401_resource.c:1209 dcn401_stream_encoder_create() error: buffer overflow 'stream_enc_regs' 4 <= 5\n\n## Affected\n\n- `Linux >= 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c < 00872dcc2a3e4a42155c2f3b7f21952a62301035`\n- `Linux >= 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c < b219b46ad42df1dea9258788bcfea37181f3ccb2`\n- `Linux >= 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c < bdf606810210e8e07a0cdf1af3c467291363b295`\n- `Linux 4.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}