All vulnerabilities
CVE-2026-99006

Linux: drm/i915/gem: Prevent overstepping exec array boundary

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in24c04e80c35ff36947366f6deafddb522eea080cAlso 152fb5083b9333a1cb8629572f9e0f276a404ba6, 72d5cbb10d4916a3f8ef9da516c5c0634aca8439CVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 24c04e80c35ff36947366f6deafddb522eea080cLinuxCVE List
  • 152fb5083b9333a1cb8629572f9e0f276a404ba6LinuxCVE List
  • 72d5cbb10d4916a3f8ef9da516c5c0634aca8439LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/gem: Prevent overstepping exec array boundary

It is possible for eb_relocate_parse_slow() to call kvfree() on entries outside the original exec array during following scenario inside eb_relocate_parse_slow():

1) eb_copy_relocations() allocates as many as eb->buffer_count copies for exec entries; 2) eb_parse() appends up to two VMAs, right after incrementing eb->buffer_count; 3) cleanup under "out" label uses this incremented buffer_count to release relocation pointers from exec array via kvfree(), not from VMA array.

To amend this problem, ensure that relocation cleanup uses the original exec object count, excluding the VMAs appended by the command parser.

(cherry picked from commit 2a0158925fb943c7ba8f3216e2734952128defc9)

Text from CVE List

Affected versions 12

  • Linuxaffected: 8e4ba491b0ba6fef69270d3c4e48fc517096ef41 before 24c04e80c35ff36947366f6deafddb522eea080cCVE List
  • Linuxaffected: 8e4ba491b0ba6fef69270d3c4e48fc517096ef41 before b1c357131fc467c579f65e9a9d1fdc1a6273ae1dCVE List
  • Linuxaffected: 8e4ba491b0ba6fef69270d3c4e48fc517096ef41 before 152fb5083b9333a1cb8629572f9e0f276a404ba6CVE List
  • Linuxaffected: 8e4ba491b0ba6fef69270d3c4e48fc517096ef41 before 72d5cbb10d4916a3f8ef9da516c5c0634aca8439CVE List
  • Linuxaffected: 8e4ba491b0ba6fef69270d3c4e48fc517096ef41 before ebe162db655881a38de43301151ff7ac940602b5CVE List
  • Linuxaffected: 5.10CVE List
  • Linuxunaffected: all versions before 5.10CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5