{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "eff682f83c9c2030761e7536c5d97e1b20f71c15"
            },
            {
              "fixed": "3c4444aec06c74fbc05661f370954ac814963c38"
            },
            {
              "fixed": "91fb41218c413989d8b6c837748751454b452d68"
            },
            {
              "fixed": "964e50ef7b8f09815a7d05b8326af700f8d5bc96"
            },
            {
              "fixed": "79e0273272a05fb26f9b1e55bf1a52eefc3b7b35"
            },
            {
              "fixed": "bfba882cfcd08f6540f72f48e786b6404f5d2c5b"
            },
            {
              "fixed": "1906064d50d194a145486e5caf3db3e708b6f6ef"
            },
            {
              "fixed": "98cfb7530ea91d8e5e928285cdce58e1131f6e83"
            },
            {
              "fixed": "f0f3981c43b32cadfe373d636d9e9ca522bb3702"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.6.0"
            },
            {
              "fixed": "5.10.259"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.11.0"
            },
            {
              "fixed": "5.15.210"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.16.0"
            },
            {
              "fixed": "6.1.176"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.2.0"
            },
            {
              "fixed": "6.6.143"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.94"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.36"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.0.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53137.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size\n\n[Why \u0026 How]\nDuring HDCP 2.x repeater authentication over HDMI, the driver reads the\nsink's RxStatus register and extracts a 10-bit message size field (max\nvalue 1023). This value is used as the read length for the ReceiverID\nlist without being clamped to the size of the destination buffer\nrx_id_list[177]. A malicious HDMI repeater could advertise a message\nsize larger than the buffer, causing an out-of-bounds write during the\nI2C read.\n\nClamp the read length in mod_hdcp_read_rx_id_list() to the size of the\nrx_id_list buffer, matching the approach already used in the DP branch.\n\n(cherry picked from commit 229212219e4247d9486f8ba41ef087358490be09)",
  "id": "CVE-2026-53137",
  "modified": "2026-07-09T03:51:36.345019754Z",
  "published": "2026-06-25T08:38:25.977Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1906064d50d194a145486e5caf3db3e708b6f6ef"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3c4444aec06c74fbc05661f370954ac814963c38"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/79e0273272a05fb26f9b1e55bf1a52eefc3b7b35"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/91fb41218c413989d8b6c837748751454b452d68"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/964e50ef7b8f09815a7d05b8326af700f8d5bc96"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/98cfb7530ea91d8e5e928285cdce58e1131f6e83"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bfba882cfcd08f6540f72f48e786b6404f5d2c5b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f0f3981c43b32cadfe373d636d9e9ca522bb3702"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53137.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53137"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.7.5",
  "summary": "drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size"
}