Linux kernel amdgpu: off-by-one in MST HDCP per-connector arrays sized 31 instead of 32
Impact
amdgpu's display code sized its MST HDCP per-connector arrays from AMDGPU_DM_MAX_DISPLAY_INDEX (31) while using the value as a count, one short of the 32 connectors DRM core supports. The 32nd connector indexes one past the end of those arrays. Reaching this requires a display pipeline with that many connectors - typically a deep DisplayPort MST chain - so on datacenter AMD accelerators running headless, with display support unused or absent, the code path is not exercised. Worth tracking for AMD-GPU workstation and remote-desktop nodes inside a fleet rather than for MI-series compute nodes.
Who can reach it
Local, and gated on physical display topology: a user able to drive the DRM connector state on a machine with an AMD GPU and enough MST-attached connectors to reach index 31. No tenant-reachable path on a headless compute node.
What to do
Update to a stable kernel that renames the constant to AMDGPU_DM_MAX_DISPLAY_COUNT and sizes the arrays to 32 (backported across stable branches; see the linked commits), then reboot into it - amdgpu cannot be reloaded under active workloads, so this is a drain and reboot. On headless compute nodes it can reasonably wait for the next scheduled kernel maintenance window.
References
Related entries
- Linux kernel amdgpu DM: CRTC reset leaves a dangling state pointer when allocation failsCVE-2026-93175 · Linux kernel amdgpu display (amdgpu_dm_crtc_reset_state)High
- Linux amdkfd: use-after-free race when two threads destroy the same compute queueCVE-2026-97429 · Linux kernel amdkfd (destroy_queue_cpsch)High
- Linux amdkfd: missing bounds check on the CRIU-supplied SDMA queue idCVE-2026-97497 · Linux kernel amdkfd (allocate_sdma_queue restore_sdma_id bounds check)High
- Linux drm/virtio: virtio-gpu hands guest-physical addresses to the host on Xen PV, exposing another domain's memoryCVE-2026-98156 · Linux kernel drm/virtio (virtio-gpu resource backing, DMA API on Xen PV)High
- accel/amdxdna: device buffers could be exported over dma-buf when they were never meant to beCVE-2026-98436 · Linux kernel accel/amdxdna (AMD XDNA NPU device buffer dma-buf export)High
- Linux kernel drm/xe: NULL pointer dereference racing VM close against eviction of a shared BOCVE-2026-98510 · Linux kernel drm/xe (VM close path, contested VMA vs page-table teardown)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.