CVE-2026-53137

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size<br /> <br /> [Why &amp; How]<br /> During HDCP 2.x repeater authentication over HDMI, the driver reads the<br /> sink&amp;#39;s RxStatus register and extracts a 10-bit message size field (max<br /> value 1023). This value is used as the read length for the ReceiverID<br /> list without being clamped to the size of the destination buffer<br /> rx_id_list[177]. A malicious HDMI repeater could advertise a message<br /> size larger than the buffer, causing an out-of-bounds write during the<br /> I2C read.<br /> <br /> Clamp the read length in mod_hdcp_read_rx_id_list() to the size of the<br /> rx_id_list buffer, matching the approach already used in the DP branch.<br /> <br /> (cherry picked from commit 229212219e4247d9486f8ba41ef087358490be09)