{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-53137",
  "modified": "2026-10-07T17:22:01Z",
  "upstream": [
    "CVE-2026-53137"
  ],
  "published": "2026-06-25T08:41:40Z",
  "summary": "drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size\n\n[Why & How]\nDuring HDCP 2.x repeater authentication over HDMI, the driver reads the\nsink's RxStatus register and extracts a 10-bit message size field (max\nvalue 1023). This value is used as the read length for the ReceiverID\nlist without being clamped to the size of the destination buffer\nrx_id_list[177]. A malicious HDMI repeater could advertise a message\nsize larger than the buffer, causing an out-of-bounds write during the\nI2C read.\n\nClamp the read length in mod_hdcp_read_rx_id_list() to the size of the\nrx_id_list buffer, matching the approach already used in the DP branch.\n\n(cherry picked from commit 229212219e4247d9486f8ba41ef087358490be09)",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.176",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53137"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/3c4444aec06c74fbc05661f370954ac814963c38"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/91fb41218c413989d8b6c837748751454b452d68"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/964e50ef7b8f09815a7d05b8326af700f8d5bc96"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/79e0273272a05fb26f9b1e55bf1a52eefc3b7b35"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/bfba882cfcd08f6540f72f48e786b6404f5d2c5b"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1906064d50d194a145486e5caf3db3e708b6f6ef"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/98cfb7530ea91d8e5e928285cdce58e1131f6e83"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f0f3981c43b32cadfe373d636d9e9ca522bb3702"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-06-25T08:41:40Z"
  }
}