Skip to main content

Linux Kernel CVE-2026-53330

| EUVDEUVD-2026-40964 HIGH
Out-of-bounds Read (CWE-125)
2026-07-01 Linux GHSA-x86r-325j-5wq6
Linux Amd Buffer Overflow Information Disclosure Red Hat Suse
High
Disputed · 7.1 NVD
Share

Severity by source

Sources disagree (Low–High)
NVD PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
4.4 MEDIUM

Local trigger via an attached DP sink's DPCD (AV:L, PR:L, AC:L); a single in-struct over-read yields only minor disclosure and possible instability, so C:L and A:L, I:N.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 23, 2026 - 21:43 vuln.today
CVSS changed
Jul 23, 2026 - 21:38 NVD
7.1 (HIGH)
Patch available
Jul 01, 2026 - 15:16 EUVD
CVE Published
Jul 01, 2026 - 13:32 nvd
HIGH 7.1
CVE Published
Jul 01, 2026 - 13:32 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()

[Why & How] The aux_rd_interval array in struct dc_lttpr_caps is declared with MAX_REPEATER_CNT - 1 (7) elements, indexed 0..6. However, the offset parameter passed to dp_get_eq_aux_rd_interval() can be as large as MAX_REPEATER_CNT (8) when a sink reports 8 LTTPR repeaters via DPCD. This leads to an out-of-bounds read of aux_rd_interval[7] when offset is 8.

Fix this by growing aux_rd_interval to MAX_REPEATER_CNT elements to accommodate the full range of valid repeater counts defined by the DP spec.

(cherry picked from commit a55a458a8df37a65ffda5cf721d554a8f74f6b04)

AnalysisAI

Out-of-bounds read in the Linux kernel's AMD Display (amdgpu DRM) DisplayPort code allows a local attacker - or a malicious/attacker-controlled DisplayPort sink - to trigger a one-element over-read of the aux_rd_interval[] array in dp_get_eq_aux_rd_interval(). The array in struct dc_lttpr_caps holds only MAX_REPEATER_CNT-1 (7) entries but is indexed with an offset up to MAX_REPEATER_CNT (8) when a sink advertises 8 LTTPR repeaters via DPCD, reading aux_rd_interval[7]. There is no public exploit identified at time of analysis, EPSS risk is low (0.17%, 6th percentile), and the vendor has released fixed kernel versions.

Technical ContextAI

The flaw lives in the AMD Display Core (DC) DisplayPort link-training logic within the amdgpu DRM driver. LTTPR (Link Training Tunable PHY Repeaters) are inline DisplayPort signal repeaters whose count is reported by the downstream device through DPCD (DisplayPort Configuration Data) registers. The DP specification permits up to MAX_REPEATER_CNT (8) repeaters, but the aux_rd_interval array in struct dc_lttpr_caps was sized to MAX_REPEATER_CNT-1 (7 entries, valid indices 0..6). When a sink reports 8 repeaters, dp_get_eq_aux_rd_interval() is called with offset 8 and reads aux_rd_interval[7], one element past the array bound. This is a classic CWE-125 Out-of-Bounds Read caused by an off-by-one mismatch between an untrusted, device-supplied count and a statically sized array. The fix grows aux_rd_interval to the full MAX_REPEATER_CNT elements.

RemediationAI

Vendor-released patch: upgrade to Linux kernel 6.18.36, 7.0.13, or 7.1 (or later) via your distribution's updates, which incorporate the stable-tree fix that grows aux_rd_interval to MAX_REPEATER_CNT elements (commits https://git.kernel.org/stable/c/454d3b3d499c18373f8960d31aea48338a3ca9e0, https://git.kernel.org/stable/c/dc1490927d79fe9621e29f4a4f5d7b5ccb6aea3e, and https://git.kernel.org/stable/c/e8b4d37eba05141ee01794fc6b7f2da808cee83b). If immediate patching is not possible, the exposure is limited to AMD-GPU systems that attach untrusted DisplayPort sinks/repeaters, so a practical compensating control is to restrict connection of untrusted DisplayPort monitors, docks, or MST hubs to affected machines (trade-off: operationally inconvenient for shared or kiosk hardware) and to limit local access on multi-user systems. There is no runtime toggle to disable LTTPR handling cleanly, so patching is strongly preferred over workarounds.

More in Amd

View all
CVE-2021-22986 CRITICAL POC
9.8 Mar 31

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
CVE-2020-6103 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6102 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6101 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6100 CRITICAL POC
9.9 Jul 20

An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. Rated criti
CVE-2018-6546 CRITICAL POC
9.8 Apr 13

plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming
CVE-2021-3653 HIGH POC
8.8 Sep 29

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. Rated high severity (CVSS 8.8), this vu
CVE-2020-12138 HIGH POC
8.8 Apr 27

AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of se
CVE-2019-5098 HIGH POC
8.6 Dec 05

An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010. Rated high
CVE-2015-7724 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
CVE-2015-7723 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
CVE-2023-1048 HIGH POC
7.8 Feb 26

A vulnerability, which was classified as critical, has been found in TechPowerUp Ryzen DRAM Calculator 1.2.0.5.sys. Rate

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53330 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy