CVE-2026-99146

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Add sanity check for DMC load address For DMC firmware header version 3, the firmware load address is stored in dmcinfo-startmmioaddr and later used by dmcloadprogram. Unlike the MMIO address table, the firmware loa...

CVE-2026-99118

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Harden DMC firmware payload parsing Validate the conversion of the DMC firmware size from dwords to bytes using checkmuloverflow before calculating the firmware payload size. Reject zero-length payloads and zero MMI...

CVE-2026-99146 drm/i915/dmc: Add sanity check for DMC load address

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Add sanity check for DMC load address For DMC firmware header version 3, the firmware load address is stored in dmcinfo-startmmioaddr and later used by dmcloadprogram. Unlike the MMIO address table, the firmware loa...

CVE-2026-99146

The Linux kernel contains a vulnerability in the drm/i915/dmc component where the firmware load address for DMC firmware header version 3 is not validated. Specifically, the address stored in dmc_info->start_mmioaddr is used by dmc_load_program() without checking if it is within the valid rang...

EUVD-2026-111898

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Add sanity check for DMC load address For DMC firmware header version 3, the firmware load address is stored in dmcinfo-startmmioaddr and later used by dmcloadprogram. Unlike the MMIO address table, the firmware loa...

CVE-2026-99118

The Linux kernel (specifically the drm/i915/dmc component) addressed a vulnerability involving the parsing of DMC firmware payloads . The root cause was a lack of validation when converting DMC firmware size from dwords to bytes, which could lead to issues during payload size calculation. To reso...

CVE-2026-99118 drm/i915/dmc: Harden DMC firmware payload parsing

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Harden DMC firmware payload parsing Validate the conversion of the DMC firmware size from dwords to bytes using checkmuloverflow before calculating the firmware payload size. Reject zero-length payloads and zero MMI...

EUVD-2026-112018

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Harden DMC firmware payload parsing Validate the conversion of the DMC firmware size from dwords to bytes using checkmuloverflow before calculating the firmware payload size. Reject zero-length payloads and zero MMI...

PT-2026-128111

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Harden DMC firmware payload parsing Validate the conversion of the DMC firmware size from dwords to bytes using check mul overflow before calculating the firmware payload size. Reject zero-length payloads and zero...

PT-2026-128139

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Add sanity check for DMC load address For DMC firmware header version 3, the firmware load address is stored in dmc info-start mmioaddr and later used by dmc load program. Unlike the MMIO address table, the firmware...

CVE-2026-23467

A flaw was found in the Linux kernel's drm/i915/dmc driver. Under specific, unlikely conditions during system startup, an uninitialized component can be accessed, leading to a null pointer dereference. This can be triggered if the Display Controller 6 DC6 hardware state is unintentionally enabled...

CVE-2026-23467: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Fix an unlikely NULL pointer deference at probe inteldmcupdatedc6allowedcount oopses when DMC hasn't been initialized, and dmc is thus NULL. That would be the case when the call path is intelpowerdomainsinithw -...