From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 410B53B3BFE for ; Thu, 17 Sep 2026 16:25:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789662357; cv=none; b=HOAzxAHPiWFv4GvMC5RY0L6Wr7jDQXa5RvqXTeKlY9KxwODLJ9Mf2XbkBPcXhixCh66PxnrdVv8VFUxCDpYiT7IJgtitI9EmDws4XKO7uv0AUpGEm9RPzfEXlPN8MJ2uEwWjfr9miMw/eBVxWtNifmXKC+2Gsa2hoP+1kYPjxXM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789662357; c=relaxed/simple; bh=MptSu7pDDvyCk9eK0iTGylBubO0t2BRkDxvd9ovGnAY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=igeiWnkrAUcaJBfgsZ7ztNQjAPtIirmLf7eYyw5Njx4edTXSvyFqG+153g0rTr1bjOud7nA7vkqRgTxl5GNw3H3fRS3TXpfAS4gbSCQNchjf44Y8ZSPN9uRSlxvmH45xdImSz+/qIFw8HswCBRSPtEEJ9Iw0P48Ou3dHUuySC4k= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=K54yhcpu; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="K54yhcpu" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9513C1F00898; Thu, 17 Sep 2026 16:25:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789662356; bh=Kg68Gg5wVIJ2xUYzW10fvx6HqIlklwxr2120/J912ls=; h=From:To:Cc:Subject:Date:Reply-To; b=K54yhcpuZu9s1pl/Q3nTjFSt5E9LbPQwqVdox1qYCXzk7nEmwqvAUDhD22gYORRLV 4CQ/yt7Jmv1Vr63d+ZrtlqAFPj5ZP+Lz2YKz6k/ixKtG/0JwDO9UZo4xSK9qQL+E/a Ohno++Tj3JuqO/z9kgD8DnQeCtFkKTKn2Vy/4ZQw= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-90289: drm/amd/display: Resize MST HDCP per-connector arrays to 32 Date: Thu, 17 Sep 2026 17:11:59 +0100 Message-ID: <2026091752-CVE-2026-90289-eef1@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2392; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=FkDwNzTdfxAxO5j3zAN+na2hJKA5KmIC+NYbaFC/Jp4=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlrBKbEFtzTY2opnR070d7VqJ2z4VbGxUzmC0t3nF1g9 fxQ7tbQjlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZjIGn6G+ZHsTyYXHZ23I1Y7 K1u2t7GoNOyqH8N8F5Uog9MFq07t/2ghoG/5OvfVea1SAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Resize MST HDCP per-connector arrays to 32 AMDGPU_DM_MAX_DISPLAY_INDEX is 31. It suggest a maximum number of 32 connectors. But the way it's used is like MAX_DISPLAY_COUNT. Hence we're off by one with DRM core, which supports a max of 32 connectors. Rename AMDGPU_DM_MAX_DISPLAY_INDEX to AMDGPU_DM_MAX_DISPLAY_COUNT to match its actual use, and increase the size to 32 to match the originally intended size. The Linux kernel CVE team has assigned CVE-2026-90289 to this issue. Affected and fixed versions =========================== Issue introduced in 6.3 with commit 82986fd631fa04bcedaefe11a6b3767601cbe84f and fixed in 7.2.6 with commit 0fa116a17b69a28712cdf209318e345b676d7f6c Issue introduced in 6.3 with commit 82986fd631fa04bcedaefe11a6b3767601cbe84f and fixed in 7.3-rc1 with commit 261e0fe4e2c99f687114b64b10b98db964b475f4 Issue introduced in 5.15.128 with commit 99c444d3c3c43db354b253d9bfac081073dcb484 Issue introduced in 6.1.47 with commit d90f97cb3821c47bdf773dcf6cade143773ec764 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-90289 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.h Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/0fa116a17b69a28712cdf209318e345b676d7f6c https://git.kernel.org/stable/c/261e0fe4e2c99f687114b64b10b98db964b475f4