In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Clamp VBIOS HDMI retimer register count to array size

[Why & How]
The VBIOS integrated info tables (v1_11 and v2_1) contain HdmiRegNum and
Hdmi6GRegNum fields that are used as loop bounds when copying retimer I2C
register settings into fixed-size arrays (dp*_ext_hdmi_reg_settings[9]
and dp*_ext_hdmi_6g_reg_settings[3]). These u8 fields are not validated
before use, so a malformed VBIOS can specify values up to 255, causing an
out-of-bounds heap write during driver probe.

Clamp each register count to the destination array size using min_t()
before the copy loops, in both get_integrated_info_v11() and
get_integrated_info_v2_1().

(cherry picked from commit 5a7f0ef90195940c54b0f5bb85b87da55f038c69)

https://git.kernel.org/stable/c/029571d51140650783be4fb98fe7cb4754752086

https://git.kernel.org/stable/c/3f32d52ec604c659725d865cf8cc6a17a33f9c6a

https://git.kernel.org/stable/c/4d1c3c26c2ab1842e139e61983395d64bd2e518b

https://git.kernel.org/stable/c/5f8b39452fb16f507c9e4d8b4a83ce27e893307c

https://git.kernel.org/stable/c/8aaa7e317fbd4beb9c6a9f77aa4cf52fae78b117

https://git.kernel.org/stable/c/d6be8e59af412623e3d874be3a048406c0edfe60

https://git.kernel.org/stable/c/fb0707ce00eef4e2d60c3020e1c0432739703e4a

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"029571d51140650783be4fb98fe7cb4754752086","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"5f8b39452fb16f507c9e4d8b4a83ce27e893307c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"4d1c3c26c2ab1842e139e61983395d64bd2e518b","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d6be8e59af412623e3d874be3a048406c0edfe60","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"3f32d52ec604c659725d865cf8cc6a17a33f9c6a","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"8aaa7e317fbd4beb9c6a9f77aa4cf52fae78b117","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"fb0707ce00eef4e2d60c3020e1c0432739703e4a","versionType":"git","status":"affected"},{"version":"0","lessThan":"5.15.210","versionType":"semver","status":"affected"},{"version":"0","lessThan":"6.1.176","versionType":"semver","status":"affected"},{"version":"0","lessThan":"6.6.143","versionType":"semver","status":"affected"},{"version":"0","lessThan":"6.12.94","versionType":"semver","status":"affected"},{"version":"0","lessThan":"6.18.36","versionType":"semver","status":"affected"},{"version":"0","lessThan":"7.0.13","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15.210","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.176","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.143","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.94","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.36","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.13","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]