Cloudanix VulnDB

CVE-2026-90289

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A coding error in AMD graphics drivers for Linux could let someone already on the computer take over the whole machine or make it crash.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Off-by-one error in AMDGPU display driver MST HDCP per-connector arrays permits out-of-bounds memory access when connector count reaches the DRM maximum of 32.

Why it matters to the business

Local attackers on AMD GPU Linux systems can achieve kernel code execution or system crashes, enabling privilege escalation and denial of service on affected hardware.

How an attack unfolds

An attacker with local access crafts display or connector configuration inputs that exceed the 31-element array bounds, triggering memory corruption in the HDCP handling code to execute arbitrary kernel code.

How to fix it

Apply the Linux kernel patch that renames AMDGPU_DM_MAX_DISPLAY_INDEX to AMDGPU_DM_MAX_DISPLAY_COUNT and increases the array size to 32.

How to confirm the fix worked

Inspect kernel source or loaded amdgpu module to confirm AMDGPU_DM_MAX_DISPLAY_COUNT equals 32 and the rename from INDEX to COUNT is present.

Typical attack path

  1. Obtain local user access on target system
  2. Use display or DRM userspace interfaces to enumerate or configure 32 connectors
  3. Trigger the off-by-one array access in the AMD display driver
  4. Exploit resulting memory corruption for privilege escalation

How to detect it

Review kernel logs for amdgpu display or HDCP stack traces indicating array bounds violations or unexpected connector counts near 32.

What your security team should do

  • Patch affected Linux kernels on AMD GPU systems at the earliest opportunity
  • Limit local unprivileged access on multi-user or shared AMD GPU hosts
  • Monitor kernel logs for amdgpu-related oops or memory corruption events

The record

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Resize MST HDCP per-connector arrays to 32 AMDGPU_DM_MAX_DISPLAY_INDEX is 31. It suggest a maximum number of 32 connectors. But the way it's used is like MAX_DISPLAY_COUNT. Hence we're off by one with DRM core, which supports a max of 32 connectors. Rename AMDGPU_DM_MAX_DISPLAY_INDEX to AMDGPU_DM_MAX_DISPLAY_COUNT to match its actual use, and increase the size to 32 to match the originally intended size.

Affected packages

Ecosystem Package Introduced Fixed