CVE-2026-99146
Linux: drm/i915/dmc: Add sanity check for DMC load address
Linux LinuxOperating systemsCVSS
NoneNot scoredExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in2fbd099b4e7c8c4ff70033c5bb950cdbb20838e2Also 7dedc5bb11f95e96fe80757c924d8d9aa7327759CVE List
What fixes it
- 2fbd099b4e7c8c4ff70033c5bb950cdbb20838e2LinuxCVE List
- 7dedc5bb11f95e96fe80757c924d8d9aa7327759LinuxCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/dmc: Add sanity check for DMC load address
For DMC firmware header version 3, the firmware load address is stored in dmc_info->start_mmioaddr and later used by dmc_load_program().
Unlike the MMIO address table, the firmware load address is not validated. Add a sanity check to ensure it is within the valid range.
BSpec: 69671, 68378 (cherry picked from commit 5e47ee5c76ca9becde8df4ad5202845b7ffcbc4c)
Text from CVE List
Affected versions 8
- Linuxaffected: 3d5928a168a9546b23c6b3439c6158d7a028326c before ef82b4d5cb4a3fe77c7f99008d78b8c64709e258CVE List
- Linuxaffected: 3d5928a168a9546b23c6b3439c6158d7a028326c before 2fbd099b4e7c8c4ff70033c5bb950cdbb20838e2CVE List
- Linuxaffected: 3d5928a168a9546b23c6b3439c6158d7a028326c before 7dedc5bb11f95e96fe80757c924d8d9aa7327759CVE List
- Linuxaffected: 5.15CVE List
- Linuxunaffected: all versions before 5.15CVE List
- Linuxunaffected: 6.18.59 through 6.18.*CVE List
- Linuxunaffected: 7.2.13 through 7.2.*CVE List
- Linuxunaffected: 7.3CVE List