Live › vulnerability › CVE-2026-99146
Go to dashboardThe Linux kernel's Intel i915 graphics driver used a DMC firmware load address from the firmware header without validating it. The fix adds a range check so an out-of-range address is rejected.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Systems running a Linux kernel with the Intel i915 graphics driver and DMC firmware header version 3 handling, typically machines with Intel integrated graphics. The sources do not say what attacker position is needed to supply a malicious firmware file, so the exposure is unknown. Systems without Intel graphics or with a patched kernel can skip it.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel versions in the upstream commit 5e47ee5c76ca9becde8df4ad5202845b7ffcbc4clsmod | grep i915Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/dmc: Add sanity check for DMC load address
For DMC firmware header version 3, the firmware load address is stored in dmc_info->start_mmioaddr and later used by dmc_load_program().
Unlike the MMIO address table, the firmware load address is not validated. Add a sanity check to ensure it is within the valid range.
BSpec: 69671, 68378 (cherry picked from commit 5e47ee5c76ca9becde8df4ad5202845b7ffcbc4c)
This page as .md · .json · in your agent: get_signal("CVE-2026-99146")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.