CVE-2026-53137: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-53137 Overview

CVE-2026-53137 is an out-of-bounds write vulnerability in the Linux kernel's AMD display driver. The flaw resides in the High-bandwidth Digital Content Protection (HDCP) 2.x repeater authentication path over HDMI. During authentication, the mod_hdcp_read_rx_id_list() function reads a 10-bit message size from the sink's RxStatus register and uses that value, up to 1023 bytes, as the I2C read length into the fixed rx_id_list[177] destination buffer. A malicious HDMI repeater can advertise an oversized message length, causing the driver to write beyond the buffer boundary. The issue was resolved by clamping the read length to the size of the destination buffer, mirroring the existing DisplayPort branch logic.

Critical Impact
A malicious HDMI repeater device can trigger kernel memory corruption through an out-of-bounds write during HDCP 2.x authentication, potentially leading to denial of service or local privilege escalation.

Affected Products

Linux kernel — drm/amd/display subsystem with HDCP 2.x repeater support over HDMI
AMD GPU display driver builds incorporating the affected mod_hdcp_read_rx_id_list() code path
Distributions shipping pre-patch stable kernels referenced in the upstream commits

Discovery Timeline

2026-06-25 - CVE-2026-53137 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53137

Vulnerability Analysis

The vulnerability sits in the HDCP 2.x repeater authentication flow handled by the AMD display module. When the driver communicates with a downstream HDMI repeater, it queries the RxStatus register to determine how many bytes of ReceiverID list data to retrieve over I2C. The RxStatus field reserves 10 bits for the message size, allowing values up to 1023. The destination buffer rx_id_list is statically sized at 177 bytes, which matches the maximum legitimate HDCP 2.x payload. Because the driver passed the attacker-controlled length directly to the I2C read routine without bounding it against the buffer size, a repeater that returned an inflated length triggered an out-of-bounds write into adjacent kernel memory.

Root Cause

The root cause is missing input validation on a length value derived from untrusted hardware. The mod_hdcp_read_rx_id_list() function trusted the size field reported by the HDMI sink and used it as the I2C transfer length. The DisplayPort branch already implemented a clamp against the buffer size, but the HDMI branch did not. The fix clamps the read length to sizeof(rx_id_list) before issuing the I2C transaction.

Attack Vector

Exploitation requires an attacker-controlled or malicious HDMI device acting as a repeater connected to a system running a vulnerable AMD GPU driver. When the driver initiates HDCP 2.x authentication, the rogue repeater advertises an oversized ReceiverID list length in RxStatus. The subsequent I2C read writes attacker-supplied bytes past the end of rx_id_list[177], corrupting adjacent kernel memory. Outcomes range from kernel panic to potential code execution depending on heap layout and surrounding data structures.

No public proof-of-concept code is available. The vulnerability mechanism is documented in the upstream kernel commits referenced in this advisory.

Detection Methods for CVE-2026-53137

Indicators of Compromise

Unexpected kernel oops, panic, or KASAN slab-out-of-bounds reports referencing mod_hdcp_read_rx_id_list or the amdgpu display module
HDCP authentication failures or repeated retries logged by the AMD display driver immediately after connecting a new HDMI device
Connection of unknown or untrusted HDMI repeater, splitter, or capture devices to systems running vulnerable AMD GPU kernels

Detection Strategies

Audit running kernel versions across managed Linux endpoints and compare against the patched stable kernel commits listed in the upstream references
Enable KASAN in test or staging kernels to surface out-of-bounds writes in the drm/amd/display HDCP path during validation
Correlate dmesg and journalctl entries containing amdgpu, hdcp, or drm errors with USB and HDMI hotplug events

Monitoring Recommendations

Forward kernel log entries to a centralized log platform and alert on crashes that name the AMD display driver
Track hardware change events on workstations and kiosks where untrusted HDMI peripherals may be attached
Monitor distribution security advisories for backports of the fix to supported stable kernel branches

How to Mitigate CVE-2026-53137

Immediate Actions Required

Apply the upstream Linux kernel patch or the equivalent backport supplied by your distribution vendor as soon as it is available
Inventory systems with AMD GPUs that perform HDCP 2.x over HDMI, including media workstations, signage, and conference room hosts
Restrict physical access to HDMI ports on at-risk systems until patched kernels are deployed

Patch Information

The fix clamps the read length in mod_hdcp_read_rx_id_list() to the size of the rx_id_list buffer, matching the existing DisplayPort behavior. It was cherry-picked from upstream commit 229212219e4247d9486f8ba41ef087358490be09. Stable branch backports are available in the following commits: Linux Kernel Commit 1906064d, Linux Kernel Commit 3c4444ae, Linux Kernel Commit 79e02732, Linux Kernel Commit 91fb4121, Linux Kernel Commit 964e50ef, Linux Kernel Commit 98cfb753, Linux Kernel Commit bfba882c, and Linux Kernel Commit f0f3981c.

Workarounds

Disable HDCP support in the AMD display driver where content protection is not required for operational use cases
Avoid connecting untrusted HDMI repeater, splitter, or capture devices to systems running unpatched AMD GPU kernels
Where feasible, prefer DisplayPort connections, which already implement the length clamp in the driver

bash

# Verify the running kernel and AMD display module on Linux hosts
uname -r
modinfo amdgpu | grep -E '^(version|srcversion|filename)'
dmesg | grep -iE 'hdcp|amdgpu' | tail -n 50