All vulnerabilities
CVE-2026-99118

Linux: drm/i915/dmc: Harden DMC firmware payload parsing

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in05f7a2f712f8b287a98ee61a7c2c6b72dad2fc6dAlso 8bb1858db453cd4250e3b633f5d2d09206024ca6CVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

  • 05f7a2f712f8b287a98ee61a7c2c6b72dad2fc6dLinuxCVE List
  • 8bb1858db453cd4250e3b633f5d2d09206024ca6LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/dmc: Harden DMC firmware payload parsing

Validate the conversion of the DMC firmware size from dwords to bytes using check_mul_overflow() before calculating the firmware payload size.

Reject zero-length payloads and zero MMIO counts in the DMC firmware header so malformed firmware is caught early. Also set dmc_fw_size only after the payload allocation succeeds.

(cherry picked from commit efde6601a1f1daedfe3dcc2816c934ddb44e3eef)

Text from CVE List

Affected versions 8

  • Linuxaffected: eb805623d8b161342ed9c9caf366f0a295041a6d before dfcfe2874e7c16e8460dc86ac1eeb54ea0e7f8aaCVE List
  • Linuxaffected: eb805623d8b161342ed9c9caf366f0a295041a6d before 05f7a2f712f8b287a98ee61a7c2c6b72dad2fc6dCVE List
  • Linuxaffected: eb805623d8b161342ed9c9caf366f0a295041a6d before 8bb1858db453cd4250e3b633f5d2d09206024ca6CVE List
  • Linuxaffected: 4.2CVE List
  • Linuxunaffected: all versions before 4.2CVE List
  • Linuxunaffected: 6.18.59 through 6.18.*CVE List
  • Linuxunaffected: 7.2.13 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3