In the Linux kernel’s DRM AMD display driver, an array used for reading extended timing parameters is sized for seven elements while the calling code may request up to eight when a sink reports eight LTTPR repeaters. This mismatch leads to an out‑of‑bounds read, exposing kernel memory contents (CWE‑125). An attacker who can trigger the read could obtain sensitive information such as kernel addresses during DisplayPort communication.

All Linux systems that ship the DRM AMD display module before the commit that expands the aux_rd_interval array are vulnerable. This includes distributions that have not yet merged the fix and are running the default AMD display driver. The issue manifests only when a connected display sink reports eight LTTPR repeaters via the DP configuration protocol. Therefore, computers with AMD GPUs that connect to monitors or docking solutions capable of advertising that many repeaters are at risk.

The EPSS score is reported as less than 1 %, suggesting a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack would require a local or physical connection to a display device that can expose eight repeaters, making it a low‑probability but still feasible vector for an attacker who can actively influence the display configuration. No known exploits have been released at this time, and the flaw’s impact is limited to information disclosure without code execution or denial of service.