Unscored severity · published Oct 28, 2026
CVE-2026-99146
drm/i915/dmc: Add sanity check for DMC load address
New
–
CVSS
–
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/dmc: Add sanity check for DMC load address
For DMC firmware header version 3, the firmware load address is stored
in dmc_info->start_mmioaddr and later used by dmc_load_program().
Unlike the MMIO address table, the firmware load address is not
validated. Add a sanity check to ensure it is within the valid range.
BSpec: 69671, 68378
(cherry picked from commit 5e47ee5c76ca9becde8df4ad5202845b7ffcbc4c)
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Linux · Linux
3d5928a168a9546b23c6b3439c6158d7a028326c before ef82b4d5cb4a3fe77c7f99008d78b8c64709e258; 3d5928a168a9546b23c6b3439c6158d7a028326c before 2fbd099b4e7c8c4ff70033c5bb950cdbb20838e2; 3d5928a168a9546b23c6b3439c6158d7a028326c before 7dedc5bb11f95e96fe80757c924d8d9aa7327759; 5.15 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-99146
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-99146
git.kernel.org
https://git.kernel.org/stable/c/ef82b4d5cb4a3fe77c7f99008d78b8c64709e258
git.kernel.org
https://git.kernel.org/stable/c/2fbd099b4e7c8c4ff70033c5bb950cdbb20838e2
git.kernel.org
https://git.kernel.org/stable/c/7dedc5bb11f95e96fe80757c924d8d9aa7327759
More from Linux
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
7.8
CVE-2026-53362
ipv6: account for fraggap on the paged allocation path
7.8
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place
7.8
CVE-2025-38352
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()