Linux Kernel DRM graphics subsystem Vulnerability Rated 7.8 CVSS

Last refreshed2026-10-15

Status: UPDATED | Advisory ID: CVE-2026-90289

Key Details

CVE	CVE-2026-90289
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-15
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel
Exploitation prediction (EPSS)	0.17% probability of exploitation in the next 30 days (5% percentile) -- FIRST.org's EPSS model.

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Resize MST HDCP per-connector arrays to 32

AMDGPU_DM_MAX_DISPLAY_INDEX is 31. It suggest a maximum number of

32 connectors. But the way it's used is like MAX_DISPLAY_COUNT.

Hence we're off by one with DRM core, which supports a max of 32

connectors.

Rename AMDGPU_DM_MAX_DISPLAY_INDEX to AMDGPU_DM_MAX_DISPLAY_COUNT

to match its actual use, and increase the size to 32 to match the

originally intended size. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-90289
CVE	https://www.cve.org/CVERecord?id=CVE-2026-90289

Source

Reference

NVD

CVE