---
id: "CVE-2026-99118"
kind: "vulnerability"
aliases: ["CVE-2026-99118"]
title: "Linux kernel i915: DMC firmware parsing hardened against malformed payload sizes"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["i915", "infrastructure", "intel-graphics", "kernel", "linux"]
not_affected_if: []
published_at: "2026-10-28T11:17:31+00:00"
first_seen_at: "2026-10-28T11:32:34+00:00"
updated_at: "2026-10-28T11:37:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99118", "first_seen_at": "2026-10-28T11:32:34+00:00"}]
---

# Linux kernel i915: DMC firmware parsing hardened against malformed payload sizes

The Linux i915 graphics driver trusted the size fields in Intel DMC firmware headers when converting dword counts to bytes, so malformed firmware could cause an overflow. The fix checks the multiplication for overflow, rejects zero-length payloads and zero MMIO counts, and sets the stored firmware size only after allocation succeeds.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-28T11:32:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99118

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/dmc: Harden DMC firmware payload parsing

Validate the conversion of the DMC firmware size from dwords to bytes
using check_mul_overflow() before calculating the firmware payload size.

Reject zero-length payloads and zero MMIO counts in the DMC firmware
header so malformed firmware is caught early. Also set dmc_fw_size only
after the payload allocation succeeds.

(cherry picked from commit efde6601a1f1daedfe3dcc2816c934ddb44e3eef)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_