The Linux kernel AMD display driver contained a vulnerability where the VBIOS integrated info tables' HdmiRegNum and Hdmi6GRegNum fields were used without validation as loop bounds for copying retimer I2C register settings into fixed-size arrays. Since these fields are u8 and unvalidated, a malformed VBIOS could specify values up to 255, causing an out-of-bounds heap write during driver initialization. The fix clamps these register counts to the destination array sizes using min_t() in the relevant functions, preventing memory corruption.

An attacker capable of providing a malformed VBIOS can trigger an out-of-bounds heap write in the AMD display driver during kernel driver probe. This can lead to memory corruption with potential consequences including system instability, denial of service, or privilege escalation. The CVSS vector indicates local attack complexity with low privileges required and no user interaction, with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability has been resolved in the Linux kernel by clamping the HDMI retimer register counts to array sizes. Users should apply the relevant Linux kernel updates once available to ensure the fix is applied.