---
id: "CVE-2026-99006"
kind: "vulnerability"
aliases: ["CVE-2026-99006"]
title: "Linux kernel i915 GPU driver: relocation cleanup frees memory out of bounds"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["i915", "intel-graphics", "linux-kernel", "package"]
not_affected_if: []
published_at: "2026-10-23T13:17:23+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T04:55:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99006", "first_seen_at": "2026-10-23T21:57:33+00:00"}]
---

# Linux kernel i915 GPU driver: relocation cleanup frees memory out of bounds

In the Linux kernel's Intel i915 graphics driver, the relocation cleanup path can call kvfree() on entries beyond the original exec array after the command parser appends VMAs. The sources do not state what an attacker gains from this memory corruption.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99006

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/gem: Prevent overstepping exec array boundary

It is possible for eb_relocate_parse_slow() to call kvfree() on
entries outside the original exec array during following
scenario inside eb_relocate_parse_slow():

1) eb_copy_relocations() allocates as many as eb->buffer_count
   copies for exec entries;
2) eb_parse() appends up to two VMAs, right after incrementing
   eb->buffer_count;
3) cleanup under "out" label uses this incremented buffer_count
   to release relocation pointers from exec array via kvfree(),
   not from VMA array.

To amend this problem, ensure that relocation cleanup uses the
original exec object count, excluding the VMAs appended by the
command parser.

(cherry picked from commit 2a0158925fb943c7ba8f3216e2734952128defc9)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_