CVE-2026-46263

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix out-of-bounds stream encoder index v3

eng_id can be negative and that stream_enc_regs[]

can be indexed out of bounds.

eng_id is used directly as an index into stream_enc_regs[], which has

only 5 entries. When eng_id is 5 (ENGINE_ID_DIGF) or negative, this can

access memory past the end of the array.

Add a bounds check using ARRAY_SIZE() before using eng_id as an index.

The unsigned cast also rejects negative values.

This avoids out-of-bounds access.

Fixes the below smatch error:

dcn*_resource.c: stream_encoder_create() may index

stream_enc_regs[eng_id] out of bounds (size 5).

drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn351/dcn351_resource.c

1246 static struct stream_encoder *dcn35_stream_encoder_create(

1247 enum engine_id eng_id,

1248 struct dc_context *ctx)

1249 {

...

1255

1256 /* Mapping of VPG, AFMT, DME register blocks to DI

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References