{"id":"CVE-2026-99118","kind":"vulnerability","aliases":["CVE-2026-99118"],"related":[],"title":"Linux kernel i915: DMC firmware parsing hardened against malformed payload sizes","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/dmc: Harden DMC firmware payload parsing\n\nValidate the conversion of the DMC firmware size from dwords to bytes\nusing check_mul_overflow() before calculating the firmware payload size.\n\nReject zero-length payloads and zero MMIO counts in the DMC firmware\nheader so malformed firmware is caught early. Also set dmc_fw_size only\nafter the payload allocation succeeds.\n\n(cherry picked from commit efde6601a1f1daedfe3dcc2816c934ddb44e3eef)","summary":"The Linux i915 graphics driver trusted the size fields in Intel DMC firmware headers when converting dword counts to bytes, so malformed firmware could cause an overflow. The fix checks the multiplication for overflow, rejects zero-length payloads and zero MMIO counts, and sets the stored firmware size only after allocation succeeds.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["i915","infrastructure","intel-graphics","kernel","linux"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-28T11:17:31+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","triaged_at":"2026-10-28T11:37:36+00:00","updated_at":"2026-10-28T11:37:36+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-28T11:37:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel i915: DMC firmware parsing hardened against malformed payload sizes","impact":"low","summary":"The Linux i915 graphics driver trusted the size fields in Intel DMC firmware headers when converting dword counts to bytes, so malformed firmware could cause an overflow. The fix checks the multiplication for overflow, rejects zero-length payloads and zero MMIO counts, and sets the stored firmware size only after allocation succeeds.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","intel-graphics","i915"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the NVD entry and the upstream kernel commit efde6601a1f1daedfe3dcc2816c934ddb44e3eef for affected kernel version ranges and whether the flaw is reachable beyond local firmware loading.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000548,"input_tokens":3417,"output_tokens":412,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99118':14A,17A 'alloc':76B,145C 'also':136C 'byte':44B,105C 'calcul':111C 'caught':134C 'caus':49B 'check':54B,107C 'cherri':147C 'commit':150C 'convers':96C 'convert':40B 'could':48B 'count':42B,67B,124C 'cve':12A,15A 'dmc':4A,36B,90C,99C,127C,138C 'driver':29B 'drm/i915/dmc':88C 'dword':41B,103C 'earli':135C 'efde6601a1f1daedfe3dcc2816c934ddb44e3eef':151C 'field':33B 'firmwar':5A,37B,47B,72B,91C,100C,113C,128C,132C 'fix':53B 'follow':83C 'fw':139C 'graphic':22B,28B 'harden':7A,89C 'header':38B,129C 'i915':3A,18B,27B 'infrastructur':19B 'intel':21B,35B 'intel-graph':20B 'kernel':2A,23B,81C 'length':62B,119C 'linux':1A,24B,26B,80C 'malform':9A,46B,131C 'mmio':66B,123C 'mul':108C 'multipl':56B 'overflow':51B,58B,109C 'pars':6A,93C 'payload':10A,63B,92C,114C,120C,144C 'pick':148C 'reject':59B,116C 'resolv':87C 'set':69B,137C 'size':11A,32B,73B,101C,115C,140C 'store':71B 'succeed':77B,146C 'trust':30B 'use':106C 'valid':94C 'vulner':84C 'zero':61B,65B,118C,122C 'zero-length':60B,117C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99118","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99118","severity":null,"published_at":"2026-10-28T11:17:31+00:00","modified_at":"2026-10-28T11:17:31+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","fetched_at":"2026-10-28T11:32:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}