CVE-2026-53137: Linux Kernel AMD Display HDMI HDCP Out-of-Bounds Write Vulnerability

Technical summary

The vulnerability resides in the mod_hdcp_read_rx_id_list() function within the AMD display driver's HDCP 2.x repeater authentication path. During HDMI authentication, the driver extracts a 10-bit message size field from the sink's RxStatus register (maximum theoretical value 1023) and uses it directly as the I2C read length for populating the rx_id_list[177] buffer without bounds checking. An attacker controlling a malicious HDMI repeater can advertise a message size exceeding 177 bytes, causing the subsequent I2C read operation to write beyond the buffer's allocated memory. The fix clamps the read length to the actual buffer size (177 bytes), aligning with the mitigation strategy already present in the DisplayPort branch of the same driver.

Business impact

Systems with AMD GPUs running affected Linux kernels are vulnerable when HDMI displays or repeaters are connected. An attacker with physical access to the HDMI port or network access to a remotely-capable display device could exploit this to corrupt kernel memory, escalate privileges, or execute arbitrary code. Impacts are most acute for workstations, desktops, and edge devices with HDMI inputs exposed to untrusted environments. Server deployments typically have minimal HDMI exposure but should still be evaluated. Data centers and virtualized environments hosting AMD GPU-accelerated workloads may face indirect exposure if guest operating systems are affected.

Affected systems

This vulnerability affects the Linux kernel across multiple stable and long-term support branches where the AMD display driver (drm/amd/display) is enabled. Systems with AMD integrated or discrete GPUs using HDMI output are at risk. The vulnerability is present in kernels prior to the patch commit (229212219e4247d9486f8ba41ef087358490be09). Users should verify the exact affected versions in their distribution's security advisory, as backport schedules vary across distributions (Fedora, Ubuntu, Debian, RHEL, SUSE, etc.).

Exploitability

Exploitation requires local or physical access to trigger HDMI repeater authentication, placing this in the low-to-medium exploitability category for most environments. The attacker must either have physical access to the HDMI port or be capable of injecting a malicious repeater device into an HDMI-connected display. No user interaction is required once a malicious repeater is connected—the vulnerability triggers during automatic HDCP negotiation. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no public active exploitation has been disclosed at this time.

Remediation

Apply kernel updates that include the patch clamping the rx_id_list read length to 177 bytes. Contact your Linux distribution vendor for the specific patched kernel version. For systems that cannot be immediately patched, mitigate by physically securing or disabling HDMI ports and avoiding connection of untrusted display devices or repeaters. Systems in isolated or trusted environments where HDMI devices are managed and vetted face lower practical risk.

Patch guidance

Monitor your Linux distribution's security advisory channels for kernel updates addressing CVE-2026-53137. The upstream fix is commit 229212219e4247d9486f8ba41ef087358490be09; verify against the vendor advisory that your distribution's patched kernel version includes this commit or an equivalent backport. Distributions typically publish patches in security bulletins (e.g., RHSA, DSA, USN) with recommended installation timelines. Test patches in non-production environments first, particularly if GPU functionality is critical to your workload. Systems with AMD GPUs used for display, compute, or transcoding should be prioritized.

Detection guidance

System logs may record I2C transaction errors or kernel warnings related to HDMI repeater authentication failures if exploitation is attempted, though detection is not guaranteed. Enable kernel debugging (dynamic debug) for the drm/amd/display module to capture more detailed authentication negotiation logs. Monitor for unexpected HDMI device disconnections or graphical glitches following repeater connection attempts, which could indicate memory corruption. Endpoint detection and response (EDR) tools may flag suspicious memory write patterns or privilege escalation attempts following HDMI authentication, but direct detection of this vulnerability's trigger is limited without kernel instrumentation.

Why prioritize this

This vulnerability warrants prompt attention due to its HIGH CVSS score (7.8), impact on memory integrity, and potential for privilege escalation. Although exploitation requires physical/local access (reducing immediate threat in many enterprise environments), the consequences of successful exploitation are severe. AMD GPU adoption in workstations and edge computing is growing, expanding the affected population. The fix is straightforward and low-risk, making remediation practical. Organizations with open HDMI ports, untrusted environments, or bring-your-own-device policies should prioritize patching.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects a HIGH severity vulnerability with local attack vector (AV:L), low attack complexity (AC:L), low privilege requirements (PR:L), no user interaction (UI:N), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The local/physical access requirement prevents a network-wide attack but does not diminish the severity of the impact once the constraint is satisfied. The combination of out-of-bounds write capability and memory corruption potential justifies the elevated score.

Frequently asked questions