{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3c4444aec06c74fbc05661f370954ac814963c38",
              "status": "affected",
              "version": "eff682f83c9c2030761e7536c5d97e1b20f71c15",
              "versionType": "git"
            },
            {
              "lessThan": "91fb41218c413989d8b6c837748751454b452d68",
              "status": "affected",
              "version": "eff682f83c9c2030761e7536c5d97e1b20f71c15",
              "versionType": "git"
            },
            {
              "lessThan": "964e50ef7b8f09815a7d05b8326af700f8d5bc96",
              "status": "affected",
              "version": "eff682f83c9c2030761e7536c5d97e1b20f71c15",
              "versionType": "git"
            },
            {
              "lessThan": "79e0273272a05fb26f9b1e55bf1a52eefc3b7b35",
              "status": "affected",
              "version": "eff682f83c9c2030761e7536c5d97e1b20f71c15",
              "versionType": "git"
            },
            {
              "lessThan": "bfba882cfcd08f6540f72f48e786b6404f5d2c5b",
              "status": "affected",
              "version": "eff682f83c9c2030761e7536c5d97e1b20f71c15",
              "versionType": "git"
            },
            {
              "lessThan": "1906064d50d194a145486e5caf3db3e708b6f6ef",
              "status": "affected",
              "version": "eff682f83c9c2030761e7536c5d97e1b20f71c15",
              "versionType": "git"
            },
            {
              "lessThan": "98cfb7530ea91d8e5e928285cdce58e1131f6e83",
              "status": "affected",
              "version": "eff682f83c9c2030761e7536c5d97e1b20f71c15",
              "versionType": "git"
            },
            {
              "lessThan": "f0f3981c43b32cadfe373d636d9e9ca522bb3702",
              "status": "affected",
              "version": "eff682f83c9c2030761e7536c5d97e1b20f71c15",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size\n\n[Why \u0026 How]\nDuring HDCP 2.x repeater authentication over HDMI, the driver reads the\nsink\u0027s RxStatus register and extracts a 10-bit message size field (max\nvalue 1023). This value is used as the read length for the ReceiverID\nlist without being clamped to the size of the destination buffer\nrx_id_list[177]. A malicious HDMI repeater could advertise a message\nsize larger than the buffer, causing an out-of-bounds write during the\nI2C read.\n\nClamp the read length in mod_hdcp_read_rx_id_list() to the size of the\nrx_id_list buffer, matching the approach already used in the DP branch.\n\n(cherry picked from commit 229212219e4247d9486f8ba41ef087358490be09)"
    }
  ],
  "id": "CVE-2026-53137",
  "lastModified": "2026-06-30T14:44:27.313",
  "metrics": {},
  "published": "2026-06-25T09:16:31.030",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/1906064d50d194a145486e5caf3db3e708b6f6ef"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3c4444aec06c74fbc05661f370954ac814963c38"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/79e0273272a05fb26f9b1e55bf1a52eefc3b7b35"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/91fb41218c413989d8b6c837748751454b452d68"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/964e50ef7b8f09815a7d05b8326af700f8d5bc96"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/98cfb7530ea91d8e5e928285cdce58e1131f6e83"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/bfba882cfcd08f6540f72f48e786b6404f5d2c5b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f0f3981c43b32cadfe373d636d9e9ca522bb3702"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Awaiting Analysis"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-53137"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-25T09:16:31Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size\n\n[Why \u0026 How]\nDuring HDCP 2.x repeater authentication over HDMI, the driver reads the\nsink\u0027s RxStatus register and extracts a 10-bit message size field (max\nvalue 1023). This value is used as the read length for the ReceiverID\nlist without being clamped to the size of the destination buffer\nrx_id_list[177]. A malicious HDMI repeater could advertise a message\nsize larger than the buffer, causing an out-of-bounds write during the\nI2C read.\n\nClamp the read length in mod_hdcp_read_rx_id_list() to the size of the\nrx_id_list buffer, matching the approach already used in the DP branch.\n\n(cherry picked from commit 229212219e4247d9486f8ba41ef087358490be09)",
  "id": "GHSA-36gr-gw56-g35v",
  "modified": "2026-06-25T09:31:18Z",
  "published": "2026-06-25T09:31:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53137"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1906064d50d194a145486e5caf3db3e708b6f6ef"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3c4444aec06c74fbc05661f370954ac814963c38"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/79e0273272a05fb26f9b1e55bf1a52eefc3b7b35"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/91fb41218c413989d8b6c837748751454b452d68"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/964e50ef7b8f09815a7d05b8326af700f8d5bc96"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/98cfb7530ea91d8e5e928285cdce58e1131f6e83"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bfba882cfcd08f6540f72f48e786b6404f5d2c5b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f0f3981c43b32cadfe373d636d9e9ca522bb3702"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-53137 drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-53137.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size",
    "tracking": {
      "current_release_date": "2026-06-28T14:40:18.000Z",
      "generator": {
        "date": "2026-06-29T07:10:52.070Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-53137",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-06-27T01:07:02.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2026-06-28T14:40:18.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cazl3 kernel 0:6.6.141.1-1.azl3",
                "product": {
                  "name": "\u003cazl3 kernel 0:6.6.141.1-1.azl3",
                  "product_id": "1"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 kernel 0:6.6.141.1-1.azl3",
                "product": {
                  "name": "azl3 kernel 0:6.6.141.1-1.azl3",
                  "product_id": "21443"
                }
              }
            ],
            "category": "product_name",
            "name": "kernel"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 kernel 0:6.6.141.1-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kernel 0:6.6.141.1-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "21443-17084"
        },
        "product_reference": "21443",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-53137",
      "notes": [
        {
          "category": "general",
          "text": "Linux",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "fixed": [
          "21443-17084"
        ],
        "known_affected": [
          "17084-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-53137 drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-53137.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-27T01:07:02.000Z",
          "details": "0:6.6.143.1-1.azl3:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-1"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        }
      ],
      "title": "drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size"
    }
  ]
}