---
id: CVE-2026-53137
title: 'drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size

  [Why & How]
  During HDCP 2.x repeater authentication over HDMI, the driver reads the
  sink's RxStatus re…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 <
    3c4444aec06c74fbc05661f370954ac814963c38
  - >-
    Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 <
    91fb41218c413989d8b6c837748751454b452d68
  - >-
    Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 <
    964e50ef7b8f09815a7d05b8326af700f8d5bc96
  - >-
    Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 <
    79e0273272a05fb26f9b1e55bf1a52eefc3b7b35
  - >-
    Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 <
    bfba882cfcd08f6540f72f48e786b6404f5d2c5b
  - >-
    Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 <
    1906064d50d194a145486e5caf3db3e708b6f6ef
  - >-
    Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 <
    98cfb7530ea91d8e5e928285cdce58e1131f6e83
  - >-
    Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 <
    f0f3981c43b32cadfe373d636d9e9ca522bb3702
  - Linux 5.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:20:32.973303Z'
published: '2026-06-25'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:24:04.063Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-53137'
references:
  - url: 'https://git.kernel.org/stable/c/3c4444aec06c74fbc05661f370954ac814963c38'
  - url: 'https://git.kernel.org/stable/c/91fb41218c413989d8b6c837748751454b452d68'
  - url: 'https://git.kernel.org/stable/c/964e50ef7b8f09815a7d05b8326af700f8d5bc96'
  - url: 'https://git.kernel.org/stable/c/79e0273272a05fb26f9b1e55bf1a52eefc3b7b35'
  - url: 'https://git.kernel.org/stable/c/bfba882cfcd08f6540f72f48e786b6404f5d2c5b'
  - url: 'https://git.kernel.org/stable/c/1906064d50d194a145486e5caf3db3e708b6f6ef'
  - url: 'https://git.kernel.org/stable/c/98cfb7530ea91d8e5e928285cdce58e1131f6e83'
  - url: 'https://git.kernel.org/stable/c/f0f3981c43b32cadfe373d636d9e9ca522bb3702'
tags:
  - cve.org
epss: 0.00143
epssPercentile: 0.03675
ingestedAt: '2026-11-06T16:57:43.280Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size

[Why & How]
During HDCP 2.x repeater authentication over HDMI, the driver reads the
sink's RxStatus register and extracts a 10-bit message size field (max
value 1023). This value is used as the read length for the ReceiverID
list without being clamped to the size of the destination buffer
rx_id_list[177]. A malicious HDMI repeater could advertise a message
size larger than the buffer, causing an out-of-bounds write during the
I2C read.

Clamp the read length in mod_hdcp_read_rx_id_list() to the size of the
rx_id_list buffer, matching the approach already used in the DP branch.

(cherry picked from commit 229212219e4247d9486f8ba41ef087358490be09)

## Affected

- `Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < 3c4444aec06c74fbc05661f370954ac814963c38`
- `Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < 91fb41218c413989d8b6c837748751454b452d68`
- `Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < 964e50ef7b8f09815a7d05b8326af700f8d5bc96`
- `Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < 79e0273272a05fb26f9b1e55bf1a52eefc3b7b35`
- `Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < bfba882cfcd08f6540f72f48e786b6404f5d2c5b`
- `Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < 1906064d50d194a145486e5caf3db3e708b6f6ef`
- `Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < 98cfb7530ea91d8e5e928285cdce58e1131f6e83`
- `Linux >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < f0f3981c43b32cadfe373d636d9e9ca522bb3702`
- `Linux 5.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.