The Linux kernel AMD display driver contained a vulnerability (CVE-2026-53137) where during HDCP 2.x repeater authentication over HDMI, the driver reads a 10-bit message size from the sink's RxStatus register and uses this value as the read length for the ReceiverID list without clamping it to the destination buffer size (rx_id_list[177]). A malicious HDMI repeater could exploit this by advertising a message size larger than the buffer, causing an out-of-bounds write during the I2C read operation. The fix involves clamping the read length in the mod_hdcp_read_rx_id_list() function to the size of the rx_id_list buffer, aligning with the approach used in the DisplayPort branch.

This vulnerability can lead to an out-of-bounds write in kernel memory, potentially allowing an attacker with local privileges and physical access to the HDMI interface to cause memory corruption. The impact includes possible privilege escalation, system instability, or denial of service. The CVSS vector indicates local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

A fix is available that clamps the read length to the buffer size in the affected function mod_hdcp_read_rx_id_list(). Users should apply the official patch or update to a fixed kernel version. Since this is a Linux kernel vulnerability, check the vendor or distribution security advisories for the patch and apply it promptly. No additional mitigations are indicated by the vendor advisory.