Executive brief
The Linux kernel's AMD GPU display driver contains an off-by-one error in HDCP encryption status tracking for multi-display setups. When systems with the maximum 32 connected displays attempt to manage HDCP content protection, the undersized array fails to track the 32nd connector, potentially leaving it unprotected or causing display connection failures.
Technical details
The vulnerability is an array bounds error in the AMDGPU display manager's HDCP (High-bandwidth Digital Content Protection) handling code. The constant AMDGPU_DM_MAX_DISPLAY_INDEX was defined as 31 but used as a loop bound in code iterating over connector arrays intended to hold 32 elements, creating an off-by-one condition. The per-connector arrays tracking HDCP encryption status and connector pointers were sized to 31 instead of 32, misaligning with the DRM core's maximum of 32 connectors. The fix renames the constant to AMDGPU_DM_MAX_DISPLAY_COUNT and increases its value to 32, ensuring proper bounds for multi-stream topology (MST) HDCP management. This affects systems with AMD GPUs running vulnerable kernel versions; no special privileges or network access are required, but impact depends on multi-display configurations.
Affected products
- Linux Linux kernel 5.4 through 6.x (before fix)
Timeline
- 2026-09-17: disclosed
- 2026-08-06: patched: Fix committed upstream; backported to stable
- 2026-07-16: other: Original patch authored