Live › vulnerability › CVE-2026-99118
Go to dashboardThe Linux i915 graphics driver trusted the size fields in Intel DMC firmware headers when converting dword counts to bytes, so malformed firmware could cause an overflow. The fix checks the multiplication for overflow, rejects zero-length payloads and zero MMIO counts, and sets the stored firmware size only after allocation succeeds.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/dmc: Harden DMC firmware payload parsing
Validate the conversion of the DMC firmware size from dwords to bytes using check_mul_overflow() before calculating the firmware payload size.
Reject zero-length payloads and zero MMIO counts in the DMC firmware header so malformed firmware is caught early. Also set dmc_fw_size only after the payload allocation succeeds.
(cherry picked from commit efde6601a1f1daedfe3dcc2816c934ddb44e3eef)
This page as .md · .json · in your agent: get_signal("CVE-2026-99118")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.