VulnerabilityPublished 25 Jun 2026Updated 6 Nov 2026

CVE-2026-53138: Linux kernel · drm/amd/display: Bound VBIOS record-chain walk loops

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in ff287df16a1a58aca78b08d1f3ee09fc44da0351 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 16:49 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in ff287df16a1a58aca78b08d1f3ee09fc44da0351, e94f5323c41f32a74160378c3b19850d1f203ad5, 6723188c42ca3b34a9fce634d7a0ecc9ccd5cd56 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Jun 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c, < ff287df16a1a58aca78b08d1f3ee09fc44da0351	Fixed in ff287df16a1a58aca78b08d1f3ee09fc44da0351
LinuxLinux	Affected ≥ 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c, < e94f5323c41f32a74160378c3b19850d1f203ad5	Fixed in e94f5323c41f32a74160378c3b19850d1f203ad5
LinuxLinux	Affected ≥ 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c, < 6723188c42ca3b34a9fce634d7a0ecc9ccd5cd56	Fixed in 6723188c42ca3b34a9fce634d7a0ecc9ccd5cd56
LinuxLinux	Affected ≥ 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c, < 6173cfea2f916e01c4f98e29cd654384a05e32a3	Fixed in 6173cfea2f916e01c4f98e29cd654384a05e32a3
LinuxLinux	Affected ≥ 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c, < 2645e3caf7e013189da9c6ff621d006cca5a538b	Fixed in 2645e3caf7e013189da9c6ff621d006cca5a538b
LinuxLinux	Affected ≥ 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c, < 499c6b43a79dd684bddbd18fe8b2235aa2764db4	Fixed in 499c6b43a79dd684bddbd18fe8b2235aa2764db4

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Bound VBIOS record-chain walk loops [Why & How] All record-chain walk loops in bios_parser.c and bios_parser2.c use for(;;) and only terminate on a 0xFF record_type sentinel or zero record_size. A malformed VBIOS image missing the terminator record causes unbounded iteration at probe time, potentially hundreds of thousands of iterations with record_size=1. In the final iterations near the BIOS image boundary, struct casts beyond the 2-byte header validated by GET_IMAGE can also read out of bounds. Cap all 14 record-chain walk loops to BIOS_MAX_NUM_RECORD (256) iterations. The atombios.h defines up to 22 distinct record types and atomfirmware.h has 13. Assuming an average of less than 10 records per type (which is reasonable since most are connector- based) 256 is a generous upper bound. (cherry picked from commit 95700a3d660287ed657d6892f7be9ffc0e294a93)

References

Community reviews

Loading reviews…