In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: fix incorrect mpc_combine array size
[why] MAXSURFACES is per stream, while MAXPLANES is per asic. The mpccombine is an array that records all the planes per asic. Therefore MAXPLANES should be used as the array size. Using MAX_SURFACES causes array overflow when there are more than 3 planes.
[how] Use the MAXPLANES for the mpccombine array size.