Unscored severity · published Oct 28, 2026
CVE-2026-99118
drm/i915/dmc: Harden DMC firmware payload parsing
New
–
CVSS
–
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/dmc: Harden DMC firmware payload parsing
Validate the conversion of the DMC firmware size from dwords to bytes
using check_mul_overflow() before calculating the firmware payload size.
Reject zero-length payloads and zero MMIO counts in the DMC firmware
header so malformed firmware is caught early. Also set dmc_fw_size only
after the payload allocation succeeds.
(cherry picked from commit efde6601a1f1daedfe3dcc2816c934ddb44e3eef)
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Linux · Linux
eb805623d8b161342ed9c9caf366f0a295041a6d before dfcfe2874e7c16e8460dc86ac1eeb54ea0e7f8aa; eb805623d8b161342ed9c9caf366f0a295041a6d before 05f7a2f712f8b287a98ee61a7c2c6b72dad2fc6d; eb805623d8b161342ed9c9caf366f0a295041a6d before 8bb1858db453cd4250e3b633f5d2d09206024ca6; 4.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-99118
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-99118
git.kernel.org
https://git.kernel.org/stable/c/dfcfe2874e7c16e8460dc86ac1eeb54ea0e7f8aa
git.kernel.org
https://git.kernel.org/stable/c/05f7a2f712f8b287a98ee61a7c2c6b72dad2fc6d
git.kernel.org
https://git.kernel.org/stable/c/8bb1858db453cd4250e3b633f5d2d09206024ca6
More from Linux
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
7.8
CVE-2026-53362
ipv6: account for fraggap on the paged allocation path
7.8
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place
7.8
CVE-2025-38352
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()