{"id":"CVE-2026-53137","title":"drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size\n\n[Why & How]\nDuring HDCP 2.x repeater authentication over HDMI, the driver reads the\nsink's RxStatus re…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < 3c4444aec06c74fbc05661f370954ac814963c38","Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < 91fb41218c413989d8b6c837748751454b452d68","Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < 964e50ef7b8f09815a7d05b8326af700f8d5bc96","Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < 79e0273272a05fb26f9b1e55bf1a52eefc3b7b35","Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < bfba882cfcd08f6540f72f48e786b6404f5d2c5b","Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < 1906064d50d194a145486e5caf3db3e708b6f6ef","Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < 98cfb7530ea91d8e5e928285cdce58e1131f6e83","Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < f0f3981c43b32cadfe373d636d9e9ca522bb3702","Linux 5.6"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:20:32.973303Z"},"published":"2026-06-25","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:24:04.063Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-53137","references":[{"url":"https://git.kernel.org/stable/c/3c4444aec06c74fbc05661f370954ac814963c38"},{"url":"https://git.kernel.org/stable/c/91fb41218c413989d8b6c837748751454b452d68"},{"url":"https://git.kernel.org/stable/c/964e50ef7b8f09815a7d05b8326af700f8d5bc96"},{"url":"https://git.kernel.org/stable/c/79e0273272a05fb26f9b1e55bf1a52eefc3b7b35"},{"url":"https://git.kernel.org/stable/c/bfba882cfcd08f6540f72f48e786b6404f5d2c5b"},{"url":"https://git.kernel.org/stable/c/1906064d50d194a145486e5caf3db3e708b6f6ef"},{"url":"https://git.kernel.org/stable/c/98cfb7530ea91d8e5e928285cdce58e1131f6e83"},{"url":"https://git.kernel.org/stable/c/f0f3981c43b32cadfe373d636d9e9ca522bb3702"}],"tags":["cve.org"],"epss":0.00143,"epssPercentile":0.03675,"ingestedAt":"2026-11-06T16:57:43.280Z","slug":"CVE-2026-53137","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size\n\n[Why & How]\nDuring HDCP 2.x repeater authentication over HDMI, the driver reads the\nsink's RxStatus register and extracts a 10-bit message size field (max\nvalue 1023). This value is used as the read length for the ReceiverID\nlist without being clamped to the size of the destination buffer\nrx_id_list[177]. A malicious HDMI repeater could advertise a message\nsize larger than the buffer, causing an out-of-bounds write during the\nI2C read.\n\nClamp the read length in mod_hdcp_read_rx_id_list() to the size of the\nrx_id_list buffer, matching the approach already used in the DP branch.\n\n(cherry picked from commit 229212219e4247d9486f8ba41ef087358490be09)\n\n## Affected\n\n- `Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < 3c4444aec06c74fbc05661f370954ac814963c38`\n- `Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < 91fb41218c413989d8b6c837748751454b452d68`\n- `Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < 964e50ef7b8f09815a7d05b8326af700f8d5bc96`\n- `Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < 79e0273272a05fb26f9b1e55bf1a52eefc3b7b35`\n- `Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < bfba882cfcd08f6540f72f48e786b6404f5d2c5b`\n- `Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < 1906064d50d194a145486e5caf3db3e708b6f6ef`\n- `Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < 98cfb7530ea91d8e5e928285cdce58e1131f6e83`\n- `Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < f0f3981c43b32cadfe373d636d9e9ca522bb3702`\n- `Linux 5.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}