CVE-2026-90289
Last modified
CVE-2026-90289 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Resize MST HDCP per-connector arrays to 32 AMDGPU_DM_MAX_DISPLAY_INDEX is 31. It suggest a maximum number of 32 connectors. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Resize MST HDCP per-connector arrays to 32 AMDGPU_DM_MAX_DISPLAY_INDEX is 31. It suggest a maximum number of 32 connectors. But the way it's used is like MAX_DISPLAY_COUNT. Hence we're off by one with DRM core, which supports a max of 32 connectors. Rename AMDGPU_DM_MAX_DISPLAY_INDEX to AMDGPU_DM_MAX_DISPLAY_COUNT to match its actual use, and increase the size to 32 to match the originally intended size.
Metrics
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= d90f97cb3821c47bdf773dcf6cade143773ec764, < 1c22294c7d9b3b1c26a18ca4eca8c863a5a0d907; >= 82986fd631fa04bcedaefe11a6b3767601cbe84f, < decea8279bec5a35413b2cb8e36951cca308fac0; >= 82986fd631fa04bcedaefe11a6b3767601cbe84f, < ac490fea9fe74f9d9975c5d8250c8719750589cd; >= 82986fd631fa04bcedaefe11a6b3767601cbe84f, < 562d24ac214ba9530d88841088eb6adce5c537b5; >= 82986fd631fa04bcedaefe11a6b3767601cbe84f, < 0fa116a17b69a28712cdf209318e345b676d7f6c; >= 82986fd631fa04bcedaefe11a6b3767601cbe84f, < 261e0fe4e2c99f687114b64b10b98db964b475f4; 99c444d3c3c43db354b253d9bfac081073dcb484; >= 6.1.47, < 6.1.191; >= 5.15.128, < 5.16 |
| Linux | Linux | 6.3 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-90289?
How severe is CVE-2026-90289?
How do I fix CVE-2026-90289?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-90283In the Linux kernel, the following vulnerability has been re…
- CVE-2026-90284In the Linux kernel, the following vulnerability has been re…
- CVE-2026-90285In the Linux kernel, the following vulnerability has been re…
- CVE-2026-90286In the Linux kernel, the following vulnerability has been re…8.8
- CVE-2026-90287In the Linux kernel, the following vulnerability has been re…
- CVE-2026-90288In the Linux kernel, the following vulnerability has been re…7.4
- CVE-2026-9029A user with Editor permissions can place a malicious script …5.4
- CVE-2026-90290In the Linux kernel, the following vulnerability has been re…
- CVE-2026-90291In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-90292In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-90293In the Linux kernel, the following vulnerability has been re…7.5
- CVE-2026-90294In the Linux kernel, the following vulnerability has been re…7.5
Are you affected by CVE-2026-90289?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST