CVE-2026-90289 (GCVE-0-2026-90289)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:08 – Updated: 2026-09-18 17:54
VLAI
Title
drm/amd/display: Resize MST HDCP per-connector arrays to 32
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Resize MST HDCP per-connector arrays to 32 AMDGPU_DM_MAX_DISPLAY_INDEX is 31. It suggest a maximum number of 32 connectors. But the way it's used is like MAX_DISPLAY_COUNT. Hence we're off by one with DRM core, which supports a max of 32 connectors. Rename AMDGPU_DM_MAX_DISPLAY_INDEX to AMDGPU_DM_MAX_DISPLAY_COUNT to match its actual use, and increase the size to 32 to match the originally intended size.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 82986fd631fa04bcedaefe11a6b3767601cbe84f , < 0fa116a17b69a28712cdf209318e345b676d7f6c (git)
Affected: 82986fd631fa04bcedaefe11a6b3767601cbe84f , < 261e0fe4e2c99f687114b64b10b98db964b475f4 (git)
Affected: 99c444d3c3c43db354b253d9bfac081073dcb484 (git)
Affected: d90f97cb3821c47bdf773dcf6cade143773ec764 (git)
Affected: 5.15.128 , < 5.16 (semver)
Affected: 6.1.47 , < 6.2 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c",
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0fa116a17b69a28712cdf209318e345b676d7f6c",
              "status": "affected",
              "version": "82986fd631fa04bcedaefe11a6b3767601cbe84f",
              "versionType": "git"
            },
            {
              "lessThan": "261e0fe4e2c99f687114b64b10b98db964b475f4",
              "status": "affected",
              "version": "82986fd631fa04bcedaefe11a6b3767601cbe84f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "99c444d3c3c43db354b253d9bfac081073dcb484",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d90f97cb3821c47bdf773dcf6cade143773ec764",
              "versionType": "git"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.128",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.47",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c",
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.128",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.47",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Resize MST HDCP per-connector arrays to 32\n\nAMDGPU_DM_MAX_DISPLAY_INDEX is 31. It suggest a maximum number of\n32 connectors. But the way it\u0027s used is like MAX_DISPLAY_COUNT.\nHence we\u0027re off by one with DRM core, which supports a max of 32\nconnectors.\n\nRename AMDGPU_DM_MAX_DISPLAY_INDEX to AMDGPU_DM_MAX_DISPLAY_COUNT\nto match its actual use, and increase the size to 32 to match the\noriginally intended size."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - hdcp_update_display() and update_config() index hdcp_workqueue.aconnector[] with aconnector-\u003ebase.index from drm_connector_init_only()\u0027s ida_alloc_max(..., 31). The path is DRM_IOCTL_MODE_ATOMIC \u2192 drm_mode_atomic_ioctl \u2192 amdgpu_dm_atomic_commit_tail \u2192 amdgpu_dm_update_hdcp()/update_psp_stream_config(); dm_dp_mst_get_modes() is reached from DRM_IOCTL_MODE_GETCONNECTOR. The index is kernel-assigned, not a protocol field.\nAC:L - No race or layout lottery: drm_connector_init_only() can assign index 31, and dm_dp_add_mst_connector() creates MST connectors until that id is used. A DRM-master atomic commit that enables that connector calls update_config(), which does hdcp_w-\u003eaconnector[conn_index] with no bounds check. hdcp_create_workqueue() is created by default on Raven-and-later GPUs.\nPR:L - drm_mode_atomic_ioctl and drm_mode_obj_set_property_ioctl are DRM_MASTER in drm_ioctl.c; drm_mode_getconnector() only calls fill_modes when drm_is_current_master(). logind grants DRM master to the seated unprivileged video/render-group user on typical AMDGPU desktops, laptops, and cloud GPU instances, so init-namespace root is not required.\nUI:N - The DRM-master attacker triggers the OOB with their own DRM_IOCTL_MODE_ATOMIC (stream enable through update_psp_stream_config(), or Content Protection via amdgpu_dm_update_hdcp()) on the index-31 connector; no other user must mount media, open a file, or attach a display on the attacker\u0027s behalf.\nS:U - aconnector[31] overwrites the following hdcp_workqueue.mutex in the same host-kernel AMDGPU HDCP object; the corruption and any oops stay inside that kernel authority and do not cross a KVM/Xen, IOMMU, or sandbox boundary.\nC:H - hdcp_update_display() holds hdcp_w-\u003emutex then reads aconnector[31], which overlays mutex.owner (the locked task_struct *). A non-NULL owner is treated as amdgpu_dm_connector * and drm_connector_put(\u0026...-\u003ebase) follows it. dm_dp_mst_get_modes() also copies hdcp_content_type[31]/content_protection[31] into connector state readable via GETCONNECTOR.\nI:H - hdcp_update_display() and update_config() write aconnector[31]=aconnector, storing an amdgpu_dm_connector * over mutex.owner while the lock is held. amdgpu_dm_update_hdcp() also writes hdcp_content_type[connector-\u003eindex] and content_protection[connector-\u003eindex] on MST. That is an out-of-bounds write into adjacent hdcp_workqueue fields.\nA:H - drm_connector_put() on mutex.owner type-confused as amdgpu_dm_connector, and later lock operations on a mutex whose owner was replaced by a connector pointer, oops or panic the kernel in amdgpu_dm_atomic_commit_tail/HDCP workqueue paths."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:54:19.186Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0fa116a17b69a28712cdf209318e345b676d7f6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/261e0fe4e2c99f687114b64b10b98db964b475f4"
        }
      ],
      "title": "drm/amd/display: Resize MST HDCP per-connector arrays to 32",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90289",
    "datePublished": "2026-09-17T16:08:17.368Z",
    "dateReserved": "2026-09-11T19:38:34.798Z",
    "dateUpdated": "2026-09-18T17:54:19.186Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90289",
      "date": "2026-09-25",
      "epss": "0.00165",
      "percentile": "0.05063"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c",
                  "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0fa116a17b69a28712cdf209318e345b676d7f6c",
                    "status": "affected",
                    "version": "82986fd631fa04bcedaefe11a6b3767601cbe84f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "261e0fe4e2c99f687114b64b10b98db964b475f4",
                    "status": "affected",
                    "version": "82986fd631fa04bcedaefe11a6b3767601cbe84f",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "99c444d3c3c43db354b253d9bfac081073dcb484",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "d90f97cb3821c47bdf773dcf6cade143773ec764",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.16",
                    "status": "affected",
                    "version": "5.15.128",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.2",
                    "status": "affected",
                    "version": "6.1.47",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c",
                  "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.3"
                  },
                  {
                    "lessThan": "6.3",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Resize MST HDCP per-connector arrays to 32\n\nAMDGPU_DM_MAX_DISPLAY_INDEX is 31. It suggest a maximum number of\n32 connectors. But the way it\u0027s used is like MAX_DISPLAY_COUNT.\nHence we\u0027re off by one with DRM core, which supports a max of 32\nconnectors.\n\nRename AMDGPU_DM_MAX_DISPLAY_INDEX to AMDGPU_DM_MAX_DISPLAY_COUNT\nto match its actual use, and increase the size to 32 to match the\noriginally intended size."
          }
        ],
        "id": "CVE-2026-90289",
        "lastModified": "2026-09-18T18:17:51.880",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:25.987",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0fa116a17b69a28712cdf209318e345b676d7f6c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/261e0fe4e2c99f687114b64b10b98db964b475f4"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.