{"id":"CVE-2026-99006","kind":"vulnerability","aliases":["CVE-2026-99006"],"related":[],"title":"Linux kernel i915 GPU driver: relocation cleanup frees memory out of bounds","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gem: Prevent overstepping exec array boundary\n\nIt is possible for eb_relocate_parse_slow() to call kvfree() on\nentries outside the original exec array during following\nscenario inside eb_relocate_parse_slow():\n\n1) eb_copy_relocations() allocates as many as eb->buffer_count\n   copies for exec entries;\n2) eb_parse() appends up to two VMAs, right after incrementing\n   eb->buffer_count;\n3) cleanup under \"out\" label uses this incremented buffer_count\n   to release relocation pointers from exec array via kvfree(),\n   not from VMA array.\n\nTo amend this problem, ensure that relocation cleanup uses the\noriginal exec object count, excluding the VMAs appended by the\ncommand parser.\n\n(cherry picked from commit 2a0158925fb943c7ba8f3216e2734952128defc9)","summary":"In the Linux kernel's Intel i915 graphics driver, the relocation cleanup path can call kvfree() on entries beyond the original exec array after the command parser appends VMAs. The sources do not state what an attacker gains from this memory corruption.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["i915","intel-graphics","linux-kernel","package"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-23T13:17:23+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:55:52+00:00","updated_at":"2026-10-25T04:55:52+00:00","category":"package","confidence":0.35,"triage":{"at":"2026-10-25T04:55:52Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel i915 GPU driver: relocation cleanup frees memory out of bounds","impact":"high","summary":"In the Linux kernel's Intel i915 graphics driver, the relocation cleanup path can call kvfree() on entries beyond the original exec array after the command parser appends VMAs. The sources do not state what an attacker gains from this memory corruption.","category":"package","nicknames":[],"who_cares":["linux-kernel","intel-graphics","i915"],"confidence":0.35,"needs_auth":"unknown","worst_case":"unknown; memory corruption in kernel driver code","analyst_note":"Find the fixed kernel versions and stable backport commit 2a0158925fb943c7ba8f3216e2734952128defc9 in the kernel.org or NVD record, and confirm the attacker-reachable impact.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running a Linux kernel with the Intel i915 DRM driver (Intel graphics). The sources do not say which kernel versions are affected or which configurations are exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000574,"input_tokens":3527,"output_tokens":443,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99006':15A,18A '1':111C '2':126C '2a0158925fb943c7ba8f3216e2734952128defc9':189C '3':140C 'alloc':115C 'amend':164C 'append':54B,129C,180C 'array':49B,83C,102C,156C,162C 'attack':63B 'beyond':45B 'bound':12A 'boundari':84C 'buffer':120C,138C,148C 'call':41B,94C 'cherri':185C 'cleanup':7A,38B,141C,170C 'command':52B,183C 'commit':188C 'copi':113C,122C 'corrupt':68B 'count':121C,139C,149C,176C 'cve':13A,16A 'driver':5A,35B 'drm/i915/gem':79C 'eb':89C,107C,112C,119C,127C,137C 'ensur':167C 'entri':44B,97C,125C 'exclud':177C 'exec':48B,82C,101C,124C,155C,174C 'follow':74C,104C 'free':8A 'gain':64B 'gpu':4A 'graphic':22B,34B 'i915':3A,19B,33B 'increment':136C,147C 'insid':106C 'intel':21B,32B 'intel-graph':20B 'kernel':2A,25B,30B,72C 'kvfree':42B,95C,158C 'label':144C 'linux':1A,24B,29B,71C 'linux-kernel':23B 'mani':117C 'memori':9A,67B 'object':175C 'origin':47B,100C,173C 'outsid':98C 'overstep':81C 'packag':26B 'pars':91C,109C,128C 'parser':53B,184C 'path':39B 'pick':186C 'pointer':153C 'possibl':87C 'prevent':80C 'problem':166C 'releas':151C 'reloc':6A,37B,90C,108C,114C,152C,169C 'resolv':78C 'right':134C 'scenario':105C 'slow':92C,110C 'sourc':57B 'state':60B 'two':132C 'use':145C,171C 'via':157C 'vma':161C 'vmas':55B,133C,179C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Intel i915 DRM driver (Intel graphics). The sources do not say which kernel versions are affected or which configurations are exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99006","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99006","severity":null,"published_at":"2026-10-23T13:17:23+00:00","modified_at":"2026-10-23T13:17:23+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}