In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
[Why & How] The VBIOS integrated info tables (v1_11 and v2_1) contain HdmiRegNum and Hdmi6GRegNum fields that are used as loop bounds when copying retimer I2C register settings into fixed-size arrays (dp*_ext_hdmi_reg_settings[9] and dp*_ext_hdmi_6g_reg_settings[3]). These u8 fields are not validated before use, so a malformed VBIOS can specify values up to 255, causing an out-of-bounds heap write during driver probe.
Clamp each register count to the destination array size using min_t() before the copy loops, in both get_integrated_info_v11() and get_integrated_info_v2_1().
(cherry picked from commit 5a7f0ef90195940c54b0f5bb85b87da55f038c69)
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Jul 5, 2026 | Jul 5, 2026 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Aug 4, 2026 | Jun 25, 2026 |
| Rocky_linux | — | Upgrade kernel-debug-modulesUpgrade kernel-tools-libsUpgrade bpftool-debuginfoUpgrade kernel-develUpgrade rtlaUpgrade python3-perf-debuginfoUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-modules-extraUpgrade kernel-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debugUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-modules-coreUpgrade kernel-rt-coreUpgrade kernel-rt-debug-develUpgrade kernel-debuginfoUpgrade kernel-rt-debuginfoUpgrade kernel-debug-uki-virtUpgrade kernel-coreUpgrade perfUpgrade kernel-modules-coreUpgrade kernel-uki-virtUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-kvmUpgrade kernel-debugUpgrade perf-debuginfoUpgrade kernel-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-rt-develUpgrade kernel-tools-debuginfoUpgrade kernel-debug-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-modulesUpgrade kernel-debug-develUpgrade kernel-debug-modules-coreUpgrade libperfUpgrade kernel-toolsUpgrade kernel-devel-matchedUpgrade python3-perfUpgrade bpftoolUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-zfcpdump-coreUpgrade kernel-debuginfo-common-s390xUpgrade kernel-zfcpdump-modules-coreUpgrade rvUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-kvmUpgrade kernel-rt-modules-extraUpgrade libperf-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade kernel-zfcpdump-modulesUpgrade kernelUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-coreUpgrade kernel-rtUpgrade kernel-uki-virt-addons | Aug 20, 2026 | Aug 18, 2026 |
| Ubuntu | — | Upgrade linux-image-realtime-hwe-26.04Upgrade linux-image-generic-64k-hwe-26.04Upgrade linux-image-nvidia-64k-hwe-26.04Upgrade linux-image-7.0.0-1019-raspi-realtimeUpgrade linux-image-nvidia-64kUpgrade linux-image-virtualUpgrade linux-image-7.0.0-31-realtime-64kUpgrade linux-image-oracle-64k-7.0Upgrade linux-image-7.0.0-31-generic-64kUpgrade linux-image-realtime-64k-7.0Upgrade linux-image-aws-64kUpgrade linux-image-azure-lts-26.04Upgrade linux-image-7.0.0-31-genericUpgrade linux-image-nvidia-bos-64kUpgrade linux-image-gke-64k-hwe-26.04Upgrade linux-image-gkeUpgrade linux-image-oem-7.0Upgrade linux-image-oracleUpgrade linux-image-gke-hwe-26.04Upgrade linux-image-7.0.0-1006-gke-64kUpgrade linux-image-nvidia-bos-7.0Upgrade linux-image-realtimeUpgrade linux-image-generic-64kUpgrade linux-image-nvidia-hwe-26.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-7.0.0-1011-oracleUpgrade linux-image-7.0.0-1019-raspiUpgrade linux-image-nvidiaUpgrade linux-image-oem-26.04bUpgrade linux-image-7.0.0-1013-ibmUpgrade linux-image-gcpUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-7.0.0-1011-gcpUpgrade linux-image-7.0.0-1011-oracle-64kUpgrade linux-image-ibm-7.0Upgrade linux-image-generic-64k-7.0Upgrade linux-image-oracle-64kUpgrade linux-image-realtime-64k-hwe-26.04Upgrade linux-image-genericUpgrade linux-image-7.0.0-1014-azureUpgrade linux-image-realtime-64kUpgrade linux-image-virtual-7.0Upgrade linux-image-7.0.0-2018-nvidia-bosUpgrade linux-image-7.0.0-1013-oemUpgrade linux-image-generic-7.0Upgrade linux-image-oem-26.04aUpgrade linux-image-oracle-7.0Upgrade linux-image-oem-26.04Upgrade linux-image-gke-7.0Upgrade linux-image-generic-hwe-26.04Upgrade linux-image-7.0.0-31-realtimeUpgrade linux-image-7.0.0-1011-gcp-64kUpgrade linux-image-7.0.0-1006-gkeUpgrade linux-image-raspi-realtime-7.0Upgrade linux-image-nvidia-64k-7.0Upgrade linux-image-awsUpgrade linux-image-ibmUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-gcp-64k-7.0Upgrade linux-image-7.0.0-1018-nvidiaUpgrade linux-image-aws-7.0Upgrade linux-image-raspiUpgrade linux-image-azure-7.0Upgrade linux-image-aws-64k-7.0Upgrade linux-image-7.0.0-1012-aws-64kUpgrade linux-image-realtime-7.0Upgrade linux-image-gcp-64kUpgrade linux-image-7.0.0-1018-nvidia-64kUpgrade linux-image-7.0.0-1012-awsUpgrade linux-image-azureUpgrade linux-image-nvidia-7.0Upgrade linux-image-7.0.0-2018-nvidia-bos-64kUpgrade linux-image-nvidia-bos-64k-7.0Upgrade linux-image-nvidia-bosUpgrade linux-image-gcp-7.0Upgrade linux-image-raspi-7.0Upgrade linux-image-virtual-hwe-26.04Upgrade linux-image-gke-64k-7.0Upgrade linux-image-gke-64k | Sep 14, 2026 | Sep 7, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 6, 2026 | Jun 25, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub