CVE-2026-53136

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amd/display: Clamp VBIOS HDMI retimer register count to array size<br /> <br /> [Why &amp; How]<br /> The VBIOS integrated info tables (v1_11 and v2_1) contain HdmiRegNum and<br /> Hdmi6GRegNum fields that are used as loop bounds when copying retimer I2C<br /> register settings into fixed-size arrays (dp*_ext_hdmi_reg_settings[9]<br /> and dp*_ext_hdmi_6g_reg_settings[3]). These u8 fields are not validated<br /> before use, so a malformed VBIOS can specify values up to 255, causing an<br /> out-of-bounds heap write during driver probe.<br /> <br /> Clamp each register count to the destination array size using min_t()<br /> before the copy loops, in both get_integrated_info_v11() and<br /> get_integrated_info_v2_1().<br /> <br /> (cherry picked from commit 5a7f0ef90195940c54b0f5bb85b87da55f038c69)