CVE-2026-90289

A flaw was found in the drm/amd/display component of the Linux kernel. An off-by-one error in the sizing of Multi-Stream Transport (MST) High-bandwidth Digital Content Protection (HDCP) per-connector arrays could lead to incorrect array handling. This issue stems from a discrepancy between the intended maximum display count and the actual array size, causing a mismatch with the Digital Rights Management (DRM) core's connector support.

A flaw with a Moderate security impact was found in the AMD display driver (drm/amd/display) of the Linux kernel as shipped in Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS, and the RHEL 9-based Red Hat CoreOS images used by OpenShift Container Platform. The driver sized its Multi-Stream Transport (MST) High-bandwidth Digital Content Protection (HDCP) per-connector arrays using AMDGPU_DM_MAX_DISPLAY_INDEX (31), although the constant is used as a connector count and the DRM core supports a maximum of 32 connectors. This off-by-one error can lead to an out-of-bounds access to these arrays when the maximum number of connectors is configured, allowing a local user to cause a kernel panic or system crash, resulting in denial of service. The Red Hat severity of Moderate reflects a local attack vector requiring low privileges and availability-only impact (CVSS 3.1 base score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). This differs from the upstream CVE.org rating of 7.8, which scores high confidentiality and integrity impacts that the available technical evidence does not support. Several older product streams, including RHEL 7 and various older RHEL 8 and RHEL 9 z-streams and OpenShift Container Platform releases, are not affected because the vulnerable code is not present. Fixes for the affected streams are deferred to a future update; because the flaw requires local access and only impacts availability, the residual risk is a local denial of service on systems using the affected AMD display driver with the maximum number of display connectors.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.