CVE-2026-53137
published 2026-06-25CVE-2026-53137: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size [Why & How] During HDCP…
PriorityP342high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.14%
4.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
[Why & How]
During HDCP 2.x repeater authentication over HDMI, the driver reads the
sink's RxStatus register and extracts a 10-bit message size field (max
value 1023). This value is used as the read length for the ReceiverID
list without being clamped to the size of the destination buffer
rx_id_list[177]. A malicious HDMI repeater could advertise a message
size larger than the buffer, causing an out-of-bounds write during the
I2C read.
Clamp the read length in mod_hdcp_read_rx_id_list() to the size of the
rx_id_list buffer, matching the approach already used in the DP branch.
(cherry picked from commit 229212219e4247d9486f8ba41ef087358490be09)
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < 3c4444aec06c74fbc05661f370954ac814963c38 | 3c4444aec06c74fbc05661f370954ac814963c38 |
| linux | linux | >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < 91fb41218c413989d8b6c837748751454b452d68 | 91fb41218c413989d8b6c837748751454b452d68 |
| linux | linux | >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < 964e50ef7b8f09815a7d05b8326af700f8d5bc96 | 964e50ef7b8f09815a7d05b8326af700f8d5bc96 |
| linux | linux | >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < 79e0273272a05fb26f9b1e55bf1a52eefc3b7b35 | 79e0273272a05fb26f9b1e55bf1a52eefc3b7b35 |
| linux | linux | >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < bfba882cfcd08f6540f72f48e786b6404f5d2c5b | bfba882cfcd08f6540f72f48e786b6404f5d2c5b |
| linux | linux | >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < 1906064d50d194a145486e5caf3db3e708b6f6ef | 1906064d50d194a145486e5caf3db3e708b6f6ef |
| linux | linux | >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < 98cfb7530ea91d8e5e928285cdce58e1131f6e83 | 98cfb7530ea91d8e5e928285cdce58e1131f6e83 |
| linux | linux | >= eff682f83c9c2030761e7536c5d97e1b20f71c15 < f0f3981c43b32cadfe373d636d9e9ca522bb3702 | f0f3981c43b32cadfe373d636d9e9ca522bb3702 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 5.11 < 5.15.210 | 5.15.210 |
| linux | linux_kernel | >= 5.16 < 6.1.176 | 6.1.176 |
| linux | linux_kernel | >= 5.6 < 5.10.259 | 5.10.259 |
| linux | linux_kernel | >= 6.13 < 6.18.36 | 6.18.36 |
| linux | linux_kernel | >= 6.19 < 7.0.13 | 7.0.13 |
| linux | linux_kernel | >= 6.2 < 6.6.143 | 6.6.143 |
| linux | linux_kernel | >= 6.7 < 6.12.94 | 6.12.94 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 7.0.12 drm mod_hdcp_read_rx_id_list out-of-bounds write (EUVD-2026-39342 / WID-SEC-2026-2077)
vuldb·2026-06-28
CVE-2026-53137 [CRITICAL] Linux Kernel up to 7.0.12 drm mod_hdcp_read_rx_id_list out-of-bounds write (EUVD-2026-39342 / WID-SEC-2026-2077)
A vulnerability was found in Linux Kernel up to 7.0.12. It has been classified as critical. This impacts the function mod_hdcp_read_rx_id_list of the component drm. The manipulation leads to out-of-bounds write.
This vulnerability is traded as CVE-2026-53137. Access to the local network is required for this attack to succeed. There is no exploit available.
Upgrading the affected component is recommended.
GHSA
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size [Why & How] During HDCP 2.x repeater authentication over HDMI, th
ghsa_unreviewed·2026-06-25
CVE-2026-53137 In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size [Why & How] During HDCP 2.x repeater authentication over HDMI, th
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
[Why & How]
During HDCP 2.x repeater authentication over HDMI, the driver reads the
sink's RxStatus register and extracts a 10-bit message size field (max
value 1023). This value is used as the read length for the ReceiverID
list without being clamped to the size of the destination buffer
rx_id_list[177]. A malicious HDMI repeater could advertise a message
size larger than the buffer, causing an out-of-bounds write during the
I2C read.
Clamp the read length in mod_hdcp_read_rx_id_list() to the size of the
rx_id_list buffer, matching the approach already used in the DP branch.
(cherry picked from commit 229212219e4247d9486f8ba41ef087358490be09)
Red Hat
kernel: drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
vendor_redhat·2026-06-25
CVE-2026-53137 CWE-787 kernel: drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
kernel: drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
[Why & How]
During HDCP 2.x repeater authentication over HDMI, the driver reads the
sink's RxStatus register and extracts a 10-bit message size field (max
value 1023). This value is used as the read length for the ReceiverID
list without being clamped to the size of the destination buffer
rx_id_list[177]. A malicious HDMI repeater could advertise a message
size larger than the buffer, causing an out-of-bounds write during the
I2C read.
Clamp the read length in mod_hdcp_read_rx_id_list() to the size of the
rx_id_list buffer, matching the approach already used in the DP branch.
(cherry pi
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/1906064d50d194a145486e5caf3db3e708b6f6efhttps://git.kernel.org/stable/c/3c4444aec06c74fbc05661f370954ac814963c38https://git.kernel.org/stable/c/79e0273272a05fb26f9b1e55bf1a52eefc3b7b35https://git.kernel.org/stable/c/91fb41218c413989d8b6c837748751454b452d68https://git.kernel.org/stable/c/964e50ef7b8f09815a7d05b8326af700f8d5bc96https://git.kernel.org/stable/c/98cfb7530ea91d8e5e928285cdce58e1131f6e83https://git.kernel.org/stable/c/bfba882cfcd08f6540f72f48e786b6404f5d2c5bhttps://git.kernel.org/stable/c/f0f3981c43b32cadfe373d636d9e9ca522bb3702
2026-06-25
Published