CVE-2026-53138

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amd/display: Bound VBIOS record-chain walk loops<br /> <br /> [Why &amp; How]<br /> All record-chain walk loops in bios_parser.c and bios_parser2.c use<br /> for(;;) and only terminate on a 0xFF record_type sentinel or zero<br /> record_size. A malformed VBIOS image missing the terminator record<br /> causes unbounded iteration at probe time, potentially hundreds of<br /> thousands of iterations with record_size=1. In the final iterations<br /> near the BIOS image boundary, struct casts beyond the 2-byte header<br /> validated by GET_IMAGE can also read out of bounds.<br /> <br /> Cap all 14 record-chain walk loops to BIOS_MAX_NUM_RECORD (256)<br /> iterations. The atombios.h defines up to 22 distinct record types<br /> and atomfirmware.h has 13. Assuming an average of less than 10<br /> records per type (which is reasonable since most are connector-<br /> based) 256 is a generous upper bound.<br /> <br /> (cherry picked from commit 95700a3d660287ed657d6892f7be9ffc0e294a93)