The vulnerability of the i915_vma_pin_ww() function in the driver/gpu/drm/i915/i915_vma.c file of the Linux operating system’s Direct Rendering Infrastructure (DRI) kernel module allows a attacker to cause a service failure.

The vulnerability of the i915vmapinww function in the drivers/gpu/drm/i915/i915vma.c file of the Direct Rendering Infrastructure DRI driver in the Linux operating system is related to the occurrence of mutual locking. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-63884

A flaw was found in the Linux kernel's Intel i915 graphics driver drm/i915. This use-after-free UAF vulnerability occurs during the TTM object purge operation. An attacker could potentially exploit this to cause a system crash, leading to a denial of service...

SUSE CVE-2026-63884

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo-ttm object might be changed by calling ttmbovalidate, move casting it to an i915tt object later to actually get the right pointer. A user reported hitting the following...

CVE-2026-63884

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo-ttm object might be changed by calling ttmbovalidate, move casting it to an i915tt object later to actually get the right pointer. A user reported hitting the following...

EUVD-2026-45769

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo-ttm object might be changed by calling ttmbovalidate, move casting it to an i915tt object later to actually get the right pointer. A user reported hitting the following...

CVE-2026-63884

CVE-2026-63884 affects the Linux kernel i915 driver with a UAF risk during TTM object purge. The issue arises when a bo->ttm object is mutated by ttm_bo_validate() and then cast to an i915_tt pointer, leading to a dereference after the object’s placement/caching policy may be changed (eviction...

CVE-2026-63884 drm/i915: Fix potential UAF in TTM object purge

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo-ttm object might be changed by calling ttmbovalidate, move casting it to an i915tt object later to actually get the right pointer. A user reported hitting the following...

PT-2026-61201

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the drm/i915 component. The problem occurs during TTM object purge when the bo-ttm object is modified by the ttm bo validate function. This can lead ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD After i915vmapinww is completed, a synchronous variant of dmafenceworkcommit is called. When pinning a VMA to GGTT address space on a Cherry View family processor...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: The zero-initialize of the eb.vma array in i915gemdoexecbuffer was corrected. The eb.vma array is initialized with values of 0 when the eb structure is first set up. Specifically, this sets the eb-vmai.vma pointers ...

K000162117: Linux kernel vulnerability CVE-2023-53552

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: drm/i915: mark requests for GuC virtual engines to avoid use-after-free References to i915requests may be trapped by userspace inside a syncfile or dmabuf dma-resv and held indefinitely across...

SUSE CVE-2026-53356

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread/pwrite with offset sgpage returns struct page pointer not void so the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO would be accessed if non-zero offset is used. Last impacted...

drm/i915/gem: Fix phys BO pread/pwrite with offset

...

Linux Distros Unpatched Vulnerability : CVE-2026-53356

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/i915/gem: Fix phys BO pread/pwrite with offset sgpage returns struct page pointer not void so the scaling of pread/pwrite is wrong for phys BO and wrong par...

CVE-2026-53356

A flaw was found in the Linux kernel's drm/i915/gem component. This vulnerability occurs because the sgpage function incorrectly scales pread/pwrite operations for physical Buffer Objects BO when a non-zero offset is used. This can lead to incorrect memory access, potentially allowing an attacker...

CVE-2026-53356

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread/pwrite with offset sgpage returns struct page pointer not void so the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO would be accessed if non-zero offset is used. Last impacted...

UBUNTU-CVE-2026-53356

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread/pwrite with offset sgpage returns struct page pointer not void so the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO would be accessed if non-zero offset is used. Last impacted...

CVE-2026-53356

CVE-2026-53356 concerns the Linux kernel’s DRM i915 GEM phys BO handling. The issue stems from sg_page() returning a struct page pointer instead of a void*, which makes pread/pwrite offset scaling incorrect and risks accessing inappropriate parts of the BO when a non-zero offset is used. The vuln...

EUVD-2026-40990

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread/pwrite with offset sgpage returns struct page pointer not void so the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO would be accessed if non-zero offset is used. Last impacted...

CVE-2026-53356 drm/i915/gem: Fix phys BO pread/pwrite with offset

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread/pwrite with offset sgpage returns struct page pointer not void so the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO would be accessed if non-zero offset is used. Last impacted...