CVE-2026-53330: Linux AMD Display Driver Out-of-Bounds Read in LTTPR Handling

Technical summary

CVE-2026-53330 is an out-of-bounds read vulnerability in drivers/gpu/drm/amd/display/dc/link/protocols/dp_dsc.c within the dp_get_eq_aux_rd_interval() function. The aux_rd_interval array in struct dc_lttpr_caps is dimensioned with MAX_REPEATER_CNT - 1 (7 elements, indices 0–6), but the DP specification permits up to MAX_REPEATER_CNT (8) LTTPR repeaters. When a sink device reports 8 repeaters via DPCD and the driver queries the 8th repeater's equalization interval, it accesses aux_rd_interval[7], which exists outside the allocated array bounds. This is a classic CWE-125 out-of-bounds read vulnerability. The fix expands aux_rd_interval to MAX_REPEATER_CNT elements to match the valid range of repeater indices.

Business impact

Organizations running AMD-based graphics hardware on Linux systems face potential data exfiltration and denial-of-service risk. The vulnerability allows unprivileged local users to leak kernel memory contents—potentially exposing cryptographic material, kernel pointers for ASLR bypass, or sensitive session data—and to crash the kernel, causing service unavailability. For enterprises with AMD GPUs in compute clusters, AI workloads, or virtual desktop infrastructure, this elevates the risk of privilege escalation chains and multi-stage attacks. Patch deployment prioritization depends on the presence of untrusted user accounts on affected systems.

Affected systems

The Linux kernel across all versions prior to the commit a55a458a8df37a65ffda5cf721d554a8f74f6b04 are affected. Any system with AMD RDNA or RDNA2 GPUs using the amdgpu driver with DisplayPort Multi-Stream Transport (MST) or LTTPR-capable sinks connected is at risk. Desktop and workstation systems with AMD Radeon RX 6000-series or newer, server systems with MI-series accelerators connected to compatible displays, and virtualized environments exposing AMD GPU PCIe functions to guest VMs are in scope. The bug requires the presence of a DP 1.4 or later sink reporting 8 repeaters to trigger; many legacy displays with fewer repeaters are unaffected.

Exploitability

Exploitation requires local code execution privileges; remote exploitation is not possible. An unprivileged user with shell access can repeatedly trigger the vulnerable code path by probing the display driver's DPCD read interface. The out-of-bounds read does not directly corrupt memory, limiting immediate system compromise, but does leak uninitialized or adjacent kernel memory. Crash-based denial-of-service is achievable through sustained polling of the vulnerable function. Public exploit code is not yet widespread, and no active in-the-wild exploitation has been reported as of the CVE publication date. The CVSS score of 7.1 (HIGH) reflects local-only access requirement with significant confidentiality impact.

Remediation

Apply the Linux kernel patch from commit a55a458a8df37a65ffda5cf721d554a8f74f6b04 or later. Affected distributions should pull this fix into their kernel branch immediately. Kernel rebuild and reboot are required for remediation. As an interim mitigation, disable unused AMD GPU PCIe pass-through in virtualized environments and restrict shell access to untrusted users on systems with AMD discrete graphics if the fixed kernel version is not yet available.

Patch guidance

Verify the fix has been merged into your distribution's kernel tree. Red Hat, Canonical, SUSE, and Arch Linux maintainers should backport commit a55a458a8df37a65ffda5cf721d554a8f74f6b04 into supported stable branches. Check your vendor's security advisory for the specific kernel version containing the fix—do not assume standard release cycles include this commit. For long-term support kernels (LTS), request or contribute the backport if not yet included. Kernel build systems should include the expanded array declaration in drivers/gpu/drm/amd/display/dc/link/protocols/dp_dsc.c.

Detection guidance

Monitor kernel logs for DisplayPort LTTPR initialization errors or repeated DPCD read failures on AMD GPU systems. Check dmesg for BUG: unable to handle page fault messages correlating with amdgpu driver activity. Userspace tools such as `drm_info` can enumerate connected DP sinks and their repeater counts; systems reporting 8 LTTPR repeaters carry immediate risk. In virtual environments, audit GPU pass-through configurations and correlate guest kernel panics with the vulnerable code paths. Intrusion detection systems should flag unusual DPCD register access patterns from unprivileged processes.

Why prioritize this

This is a kernel-level memory corruption vulnerability in a widely-deployed open-source component affecting AMD GPU users across multiple deployment models. The HIGH CVSS score, local-only exploitability, and the potential for information disclosure and denial-of-service make it suitable for rapid patch deployment, particularly for multi-tenant systems or those with AMD GPUs connected to LTTPR-capable displays. Organizations without AMD discrete graphics are unaffected and may defer patching to their next scheduled kernel update cycle.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) is driven by: (1) local attack vector, limiting scope but requiring privilege escalation in single-user systems; (2) low attack complexity—no special conditions or user interaction required; (3) high confidentiality impact via kernel memory leakage; (4) high availability impact through denial-of-service; (5) no integrity impact, as the read-only nature prevents direct file or kernel state corruption. The score reflects realistic risk for enterprises with GPU-dense infrastructure and permissive user access policies.

Frequently asked questions