7.8

CVE-2026-90289: drm/amd/display: Resize MST HDCP per-connector arrays to 32

Received
AliasesUBUNTU-CVE-2026-90289DEBIAN-CVE-2026-90289
Published 17-09-2026Last modified 30-10-2026

Vulnerability summary

CVE-2026-90289 is a high (CVSS 7.8) vulnerability in linux. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.3% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.17%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10 · Related 10
OPENSUSE-SU-2026:11880-1OPENSUSE-SU-2026:22167-1SUSE-SU-2026:24371-1SUSE-SU-2026:24379-1SUSE-SU-2026:24386-1SUSE-SU-2026:24422-1

Timeline

  1. 17-09-2026
    PublishedVulnerability first disclosed.
  2. 30-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Resize MST HDCP per-connector arrays to 32 AMDGPU_DM_MAX_DISPLAY_INDEX is 31. It suggest a maximum number of 32 connectors. But the way it's used is like MAX_DISPLAY_COUNT. Hence we're off by one with DRM core, which supports a max of 32 connectors. Rename AMDGPU_DM_MAX_DISPLAY_INDEX to AMDGPU_DM_MAX_DISPLAY_COUNT to match its actual use, and increase the size to 32 to match the originally intended size.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.17%

Chance of exploitation in the next 30 days

Percentile

6%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.17% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu157 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linuxAll versions (No fix recorded) | < 6.12.115-2 | < 7.2.6-1
Linux1 product
  • linux≥ d90f97cb3821c47bdf773dcf6cade143773ec764, < 1c22294c7d9b3b1c26a18ca4eca8c863a5a0d907 | ≥ 82986fd631fa04bcedaefe11a6b3767601cbe84f, < decea8279bec5a35413b2cb8e36951cca308fac0 | ≥ 82986fd631fa04bcedaefe11a6b3767601cbe84f, < ac490fea9fe74f9d9975c5d8250c8719750589cd | ≥ 82986fd631fa04bcedaefe11a6b3767601cbe84f, < 562d24ac214ba9530d88841088eb6adce5c537b5 | ≥ 82986fd631fa04bcedaefe11a6b3767601cbe84f, < 0fa116a17b69a28712cdf209318e345b676d7f6c | ≥ 82986fd631fa04bcedaefe11a6b3767601cbe84f, < 261e0fe4e2c99f687114b64b10b98db964b475f4 | 99c444d3c3c43db354b253d9bfac081073dcb484 | ≥ 6.1.47, < 6.1.191 | ≥ 5.15.128, < 5.16 | 6.3

3 vendors · 159 products

References

10 links