CVE-2026-53138: Linux Kernel AMD Display DoS Vulnerability

CVE-2026-53138 Overview

CVE-2026-53138 is a Linux kernel vulnerability in the AMD display driver (drm/amd/display). The flaw resides in VBIOS record-chain walk loops within bios_parser.c and bios_parser2.c. These loops use unbounded for(;;) constructs that terminate only on a 0xFF record_type sentinel or a zero record_size. A malformed VBIOS image lacking the terminator record causes unbounded iteration at probe time. Late iterations near the BIOS image boundary can also perform structure casts beyond the 2-byte header validated by GET_IMAGE, producing out-of-bounds reads. The upstream fix caps all 14 record-chain walk loops at BIOS_MAX_NUM_RECORD (256) iterations.

Critical Impact
A malformed VBIOS can trigger unbounded looping and out-of-bounds memory reads during AMD GPU probe, leading to denial of service on affected Linux systems.

Affected Products

Linux kernel versions containing the unbounded VBIOS record-chain walk loops in drm/amd/display
Systems with AMD GPUs initialized via the amdgpu driver and bios_parser/bios_parser2 code paths
Distributions shipping affected kernels prior to receiving the backported fix

Discovery Timeline

2026-06-25 - CVE-2026-53138 published to the National Vulnerability Database (NVD)
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53138

Vulnerability Analysis

The vulnerability exists in the AMD Display Core VBIOS parsing logic. The bios_parser.c and bios_parser2.c source files contain 14 distinct loops that walk record chains embedded in the VBIOS image. Each loop is structured as for(;;) and depends on encountering either a record_type value of 0xFF (sentinel) or a record_size of zero to break out.

When the VBIOS image is malformed and omits the terminator record, the loop continues iterating past the intended chain boundary. With a record_size of 1, the loop can execute hundreds of thousands of iterations. In iterations near the BIOS image boundary, the code performs struct casts that exceed the 2-byte header that GET_IMAGE actually validates, resulting in out-of-bounds reads of adjacent memory.

The vulnerability falls into two related classes: an infinite loop denial-of-service condition and an out-of-bounds read [CWE-125]. Triggering the issue requires the kernel to parse an attacker-influenced or corrupted VBIOS, typically at driver probe time.

Root Cause

The root cause is missing iteration bounds on data-driven loops that consume firmware-supplied content. The parser trusts the VBIOS to contain a properly formed terminator and never enforces a maximum loop count. The header validation performed by GET_IMAGE covers only 2 bytes, while subsequent struct casts read larger structures, allowing reads past validated memory.

Attack Vector

An attacker who can supply or modify the VBIOS image consumed by the kernel can trigger the condition. This includes scenarios where firmware blobs are loaded from disk, supplied via an attached device, or present on systems with a tampered option ROM. The result is a long stall or hang during GPU probe and potential information leakage through out-of-bounds reads. The vulnerability is reachable during driver initialization rather than from unprivileged userspace input.

No verified public proof-of-concept code is available. See the upstream commits for the precise fix:

Detection Methods for CVE-2026-53138

Indicators of Compromise

Kernel log messages from amdgpu indicating hangs, soft lockups, or RCU stalls during driver probe
Extended boot delays on systems with AMD GPUs, particularly during display subsystem initialization
Unexpected KASAN or UBSAN reports referencing bios_parser.c or bios_parser2.c functions if such instrumentation is enabled

Detection Strategies

Inventory running kernel versions across the fleet and compare against the patched commit IDs in the stable tree
Audit systems that allow custom or replaceable VBIOS/option ROM images, including virtualized environments with GPU passthrough
Enable kernel sanitizers (KASAN, UBSAN) in test environments to surface out-of-bounds reads in the AMD display driver

Monitoring Recommendations

Centralize kernel ring buffer (dmesg) and journalctl -k output to a SIEM for analysis of GPU driver probe failures
Alert on repeated boot-time soft lockups, hung tasks, or watchdog events involving amdgpu
Track firmware integrity for VBIOS and option ROMs on managed endpoints and servers using AMD graphics hardware

How to Mitigate CVE-2026-53138

Immediate Actions Required

Apply the upstream Linux kernel patches that cap each of the 14 record-chain walk loops at BIOS_MAX_NUM_RECORD (256) iterations
Update to a distribution kernel package that incorporates the cherry-picked fix from commit 95700a3d660287ed657d6892f7be9ffc0e294a93
Restrict the ability of untrusted users to supply or replace VBIOS images, especially in virtualization and GPU passthrough deployments

Patch Information

The fix bounds all record-chain walk loops in bios_parser.c and bios_parser2.c to a maximum of 256 iterations. The patch was backported to stable trees across the commits referenced above. Rebuild and reboot is required for the kernel change to take effect.

Workarounds

Where patching is not immediately feasible, ensure VBIOS images delivered to the kernel come only from trusted, verified sources
For virtualized hosts, disable GPU passthrough or option ROM loading from guest-controlled storage until the host kernel is patched
Consider blacklisting the amdgpu module on systems that do not require AMD graphics functionality and where alternative drivers suffice

bash

# Verify the running kernel includes the fix by checking the patched commit
# Replace <kernel-source> with the path to your kernel source tree
git -C <kernel-source> log --oneline | grep -E '95700a3d660287ed657d6892f7be9ffc0e294a93'

# Check the running kernel version against distribution advisories
uname -r

# Inspect dmesg for amdgpu probe issues that may indicate exposure
dmesg | grep -iE 'amdgpu|bios_parser|soft lockup|hung task'