{"id":"CVE-2026-99146","kind":"vulnerability","aliases":["CVE-2026-99146"],"related":[],"title":"Linux kernel: missing bounds check on i915 DMC firmware load address","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/dmc: Add sanity check for DMC load address\n\nFor DMC firmware header version 3, the firmware load address is stored\nin dmc_info->start_mmioaddr and later used by dmc_load_program().\n\nUnlike the MMIO address table, the firmware load address is not\nvalidated. Add a sanity check to ensure it is within the valid range.\n\nBSpec: 69671, 68378\n(cherry picked from commit 5e47ee5c76ca9becde8df4ad5202845b7ffcbc4c)","summary":"The Linux kernel's Intel i915 graphics driver used a DMC firmware load address from the firmware header without validating it. The fix adds a range check so an out-of-range address is rejected.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["i915","intel-graphics","kernel","linux","runtime"],"not_affected_if":["no-intel-graphics"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel versions in the upstream commit 5e47ee5c76ca9becde8df4ad5202845b7ffcbc4c\n- Check whether the i915 driver is loaded with `lsmod | grep i915`\n- unknown whether the sources list an exact affected version range","fix":"- Update the Linux kernel to a release that includes commit 5e47ee5c76ca9becde8df4ad5202845b7ffcbc4c, from your distribution's kernel updates\n- unknown for exact fixed version numbers, as the sources do not list them","status":"open","published_at":"2026-10-28T11:17:34+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","triaged_at":"2026-10-28T11:36:01+00:00","updated_at":"2026-10-28T11:36:01+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-28T11:36:01Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes commit 5e47ee5c76ca9becde8df4ad5202845b7ffcbc4c, from your distribution's kernel updates\n- unknown for exact fixed version numbers, as the sources do not list them","reach":"local","title":"Linux kernel: missing bounds check on i915 DMC firmware load address","impact":"medium","summary":"The Linux kernel's Intel i915 graphics driver used a DMC firmware load address from the firmware header without validating it. The fix adds a range check so an out-of-range address is rejected.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","intel-graphics","i915"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown, the sources do not describe the impact","analyst_note":"Find the NVD or kernel.org record for CVE-2026-99146 to confirm severity, affected versions and whether an unprivileged user can trigger it.","how_to_check":"- Run `uname -r` and compare against the fixed kernel versions in the upstream commit 5e47ee5c76ca9becde8df4ad5202845b7ffcbc4c\n- Check whether the i915 driver is loaded with `lsmod | grep i915`\n- unknown whether the sources list an exact affected version range","needs_analyst":true,"not_affected_if":["no-intel-graphics"],"who_is_affected":"Systems running a Linux kernel with the Intel i915 graphics driver and DMC firmware header version 3 handling, typically machines with Intel integrated graphics. The sources do not say what attacker position is needed to supply a malicious firmware file, so the exposure is unknown. Systems without Intel graphics or with a patched kernel can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000665,"input_tokens":3410,"output_tokens":648,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99146':14A,17A '3':84C '5e47':134C '68378':129C '69671':128C 'add':48B,72C,115C 'address':11A,38B,58B,78C,88C,106C,111C 'bound':4A 'bspec':127C 'check':5A,51B,74C,118C 'cherri':130C 'commit':133C 'cve':12A,15A 'dmc':8A,35B,76C,80C,92C,100C 'driver':32B 'drm/i915/dmc':71C 'ee5c76ca9becde8df4ad5202845b7ffcbc4c':135C 'ensur':120C 'firmwar':9A,36B,41B,81C,86C,109C 'fix':47B 'follow':66C 'graphic':21B,31B 'header':42B,82C 'i915':7A,18B,30B 'info':93C 'intel':20B,29B 'intel-graph':19B 'kernel':2A,22B,27B,64C 'later':97C 'linux':1A,23B,26B,63C 'load':10A,37B,77C,87C,101C,110C 'miss':3A 'mmio':105C 'mmioaddr':95C 'out-of-rang':54B 'pick':131C 'program':102C 'rang':50B,57B,126C 'reject':60B 'resolv':70C 'runtim':24B 'saniti':73C,117C 'start':94C 'store':90C 'tabl':107C 'unlik':103C 'use':33B,98C 'valid':44B,114C,125C 'version':83C 'vulner':67C 'within':123C 'without':43B","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Intel i915 graphics driver and DMC firmware header version 3 handling, typically machines with Intel integrated graphics. The sources do not say what attacker position is needed to supply a malicious firmware file, so the exposure is unknown. Systems without Intel graphics or with a patched kernel can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99146","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99146","severity":null,"published_at":"2026-10-28T11:17:34+00:00","modified_at":"2026-10-28T11:17:34+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","fetched_at":"2026-10-28T11:32:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}