{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm\/amd\/display: Fix out-of-bounds stream encoder index v3\\n\\neng_id can be negative and that stream_enc_regs[]\\ncan be indexed out of bounds.\\n\\neng_id is used directly as an index into stream_enc_regs[], which has\\nonly 5 entries. When eng_id is 5 (ENGINE_ID_DIGF) or negative, this can\\naccess memory past the end of the array.\\n\\nAdd a bounds check using ARRAY_SIZE() before using eng_id as an index.\\nThe unsigned cast also rejects negative values.\\n\\nThis avoids out-of-bounds access.\\n\\nFixes the below smatch error:\\ndcn*_resource.c: stream_encoder_create() may index\\nstream_enc_regs[eng_id] out of bounds (size 5).\\n\\ndrivers\/gpu\/drm\/amd\/amdgpu\/..\/display\/dc\/resource\/dcn351\/dcn351_resource.c\\n 1246 static struct stream_encoder *dcn35_stream_encoder_create(\\n 1247 enum engine_id eng_id,\\n 1248 struct dc_context *ctx)\\n 1249 {\\n\\n …\\n\\n 1255\\n 1256 \/* Mapping of VPG, AFMT, DME register blocks to DIO block instance *\/\\n 1257 if (eng_id \\u003c= ENGINE_ID_DIGF) {\\n\\nENGINE_ID_DIGF is 5. should \\u003c= be \\u003c?\\n\\nUnrelated but, ugh, why is Smatch saying that \\”eng_id\\” can be negative?\\nend_id is type signed long, but there are checks in the caller which prevent it from being negative.\\n\\n 1258 vpg_inst = eng_id;\\n 1259 afmt_inst = eng_id;\\n 1260 } else\\n 1261 return NULL;\\n 1262\\n\\n …\\n\\n 1281\\n 1282 dcn35_dio_stream_encoder_construct(enc1, ctx, ctx-\\u003edc_bios,\\n 1283 eng_id, vpg, afmt,\\n–\\u003e 1284 \\u0026stream_enc_regs[eng_id],\\n ^^^^^^^^^^^^^^^^^^^^^^^ This stream_enc_regs[] array has 5 elements so we are one element beyond the end of the array.\\n\\n …\\n\\n 1287 return \\u0026enc1-\\u003ebase;\\n 1288 }\\n\\nv2: use explicit bounds check as suggested by Roman\/Dan; avoid unsigned int cast\\n\\nv3: The compiler already knows how to compare the two values, so the\\n cast (int) is not needed. (Roman)”,”published”:”2026-06-03T15:50:02.572Z”,”modified”:”2026-06-05T06:06:33.332Z”,”type”:”cve”,”title”:”drm\/amd\/display: Fix out-of-bounds stream encoder index v3″,”source”:”Linux”,”references”:”https:\/\/git.kernel.org\/stable\/c\/29f3824b08a98d41ecbbfd33580630d7607f962e\\nhttps:\/\/git.kernel.org\/stable\/c\/263e28add4f4472cfa95150d218955d1945aa413\\nhttps:\/\/git.kernel.org\/stable\/c\/ca3808d560ad946ab6d089fd1f5bee04b952ead4\\nhttps:\/\/git.kernel.org\/stable\/c\/abde491143e4e12eecc41337910aace4e8d59603″,”id”:”CVE-2026-46263″,”bulletinFamily”:””,”cwe”:null,”cvelist”:null,”sourceData”:”Linux Linux 2728e9c7c84235d2d7bc1403174d071ffc82d6d2\\nLinux Linux 2728e9c7c84235d2d7bc1403174d071ffc82d6d2\\nLinux Linux 2728e9c7c84235d2d7bc1403174d071ffc82d6d2\\nLinux Linux 2728e9c7c84235d2d7bc1403174d071ffc82d6d2\\nLinux Linux 6.9″,”sourceHref”:””,”cvss”:{“score”:7.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:L\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Linux”,”version”:”2728e9c7c84235d2d7bc1403174d071ffc82d6d2″,”vendor”:”Linux”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm\/amd\/display: Fix out-of-bounds stream encoder index v3\\n\\neng_id can be negative and that stream_enc_regs[]\\ncan be indexed out…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,28,12,15,13,7,11,5],"class_list":["post-59985","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-78","tag-exploit","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n