Linux Kernel CVE-2026-90289

Requires an AMD GPU using the amdgpu drm/amd/display driver with HDCP-over-MST in use, AND a Multi-Stream Transport topology (MST hub/daisy-chain) that exposes the full DRM-supported maximum of 32 connectors - only the 32nd connector triggers the off-by-one on the per-connector HDCP arrays. Exploitation is LIMITED by this physical/topology precondition (assembling 32 MST connectors is uncommon), by requiring local access (AV:L) to a machine with AMD graphics, and by the bug being a bounded single-element overrun rather than an attacker-sized overflow; typical desktops with 1-3 displays never reach the vulnerable index.

This is an off-by-one array-sizing bug in the AMD display driver (drm/amd/display): AMDGPU_DM_MAX_DISPLAY_INDEX was 31 but used as a count/size while DRM core permits 32 connectors, so MST HDCP per-connector arrays are one element too small and a 32nd connector indexes out of bounds. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) treats this as trivially reachable local code with full CIA impact - I assess that as overstated. Reaching the OOB condition requires a real 32-display MST daisy-chain to be attached, which is a hardware/topology precondition rather than a software input an attacker can freely set, so effective attack complexity is HIGH, not LOW. The tag 'Information Disclosure' is misleading: this is an out-of-bounds array access (memory corruption / off-by-one), crash-and-corruption primary, with any leak strictly incidental - C:H/I:H is not justified for a bounded off-by-one on HDCP state arrays. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' Net: a legitimate reliability/robustness fix, but a low real-world security priority, not a genuine 7.8. Signals are consistent in that all point to a local, non-remote issue; the main conflict is between the vendor's high impact/low-complexity rating and the described physical precondition.

A user or attacker with local access connects an MST hub topology exposing 32 downstream connectors to an AMD GPU; when the driver populates HDCP per-connector state for the 32nd connector, it writes/reads one element past the fixed-size arrays, corrupting adjacent kernel memory or triggering a crash. No public proof-of-concept is identified, and the scenario depends on assembling a full 32-connector MST chain, making opportunistic exploitation impractical.