CVE-2026-53330

drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()

State: Published
Severity: Not scored
Published: Jul 1, 2026
Updated: Oct 30, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()

[Why & How] The aux_rd_interval array in struct dc_lttpr_caps is declared with MAX_REPEATER_CNT - 1 (7) elements, indexed 0..6. However, the offset parameter passed to dp_get_eq_aux_rd_interval() can be as large as MAX_REPEATER_CNT (8) when a sink reports 8 LTTPR repeaters via DPCD. This leads to an out-of-bounds read of aux_rd_interval[7] when offset is 8.

Fix this by growing aux_rd_interval to MAX_REPEATER_CNT elements to accommodate the full range of valid repeater counts defined by the DP spec.

(cherry picked from commit a55a458a8df37a65ffda5cf721d554a8f74f6b04)

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8e5100a575433cc185a2e224280fbd873b6692dd to before 7b310c6d82d782282085c9728dfe69e07d185b6cAffected 8e5100a575433cc185a2e224280fbd873b6692dd to before a632474c793b7f2a9bbd3d8e3d0dd7d256989300Affected 8e5100a575433cc185a2e224280fbd873b6692dd to before 7c5f2d16a8f4464bf2a719ceb2316b8a6b87a3c0Affected 8e5100a575433cc185a2e224280fbd873b6692dd to before 454d3b3d499c18373f8960d31aea48338a3ca9e0Affected 8e5100a575433cc185a2e224280fbd873b6692dd to before dc1490927d79fe9621e29f4a4f5d7b5ccb6aea3eAffected 8e5100a575433cc185a2e224280fbd873b6692dd to before e8b4d37eba05141ee01794fc6b7f2da808cee83bAffected
LinuxLinux	5.6Affected before 5.6Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.36 through 6.18.Not affected 7.0.13 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

8e5100a575433cc185a2e224280fbd873b6692dd to before 7b310c6d82d782282085c9728dfe69e07d185b6cAffected
8e5100a575433cc185a2e224280fbd873b6692dd to before a632474c793b7f2a9bbd3d8e3d0dd7d256989300Affected
8e5100a575433cc185a2e224280fbd873b6692dd to before 7c5f2d16a8f4464bf2a719ceb2316b8a6b87a3c0Affected
8e5100a575433cc185a2e224280fbd873b6692dd to before 454d3b3d499c18373f8960d31aea48338a3ca9e0Affected
8e5100a575433cc185a2e224280fbd873b6692dd to before dc1490927d79fe9621e29f4a4f5d7b5ccb6aea3eAffected
8e5100a575433cc185a2e224280fbd873b6692dd to before e8b4d37eba05141ee01794fc6b7f2da808cee83bAffected

LinuxLinux

5.6Affected
before 5.6Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.36 through 6.18.*Not affected
7.0.13 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.