CVE-2026-99118unknown
drm/i915/dmc: Harden DMC firmware payload parsing
Impact
In the Linux kernel, the following vulnerability has been resolved:
Source excerpt · LinuxAffected packages
This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Linux · Linux
Other versions: unaffected
| Version / range | Source status |
|---|---|
| eb805623d8b161342ed9c9caf366f0a295041a6d to before dfcfe2874e7c16e8460dc86ac1eeb54ea0e7f8aa | affected |
| eb805623d8b161342ed9c9caf366f0a295041a6d to before 05f7a2f712f8b287a98ee61a7c2c6b72dad2fc6d | affected |
| eb805623d8b161342ed9c9caf366f0a295041a6d to before 8bb1858db453cd4250e3b633f5d2d09206024ca6 | affected |
Linux · Linux
Other versions: affected
| Version / range | Source status |
|---|---|
| 4.2 | affected |
| 0 to before 4.2 | unaffected |
| 6.18.59 through 6.18.* (inclusive) | unaffected |
| 7.2.13 through 7.2.* (inclusive) | unaffected |
| 7.3 through * (inclusive) | unaffected |
Original source description
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/dmc: Harden DMC firmware payload parsing
Validate the conversion of the DMC firmware size from dwords to bytes using check_mul_overflow() before calculating the firmware payload size.
Reject zero-length payloads and zero MMIO counts in the DMC firmware header so malformed firmware is caught early. Also set dmc_fw_size only after the payload allocation succeeds.
(cherry picked from commit efde6601a1f1daedfe3dcc2816c934ddb44e3eef)