CVE-2026-89822

drm/i915: Guard against NULL driver_data in i915_pci_probe()

Published Sep 16, 2026 CVSS n/a EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/i915: Guard against NULL driver_data in i915_pci_probe()

pci_match_device() can return the dummy pci_device_id_any entry
when a device is force-bound via sysfs driver_override, in which
case ->driver_data is unset (NULL). i915_pci_probe() casts it to
struct intel_device_info * unconditionally and dereferences
intel_info->require_force_probe, causing a NULL-ptr-deref.

(cherry picked from commit 2727922084672cc274ecea726ea00363c2893731)

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`782a985d7af26db39e86070d28f987cad21313c0`	affected	< 2239e6b49d33bb38817d69b4f0bf7d5cbde2ec68
`782a985d7af26db39e86070d28f987cad21313c0`	affected	< 4a0236fe97732e31cb4a6dcb433642f9e3ef9a56
`782a985d7af26db39e86070d28f987cad21313c0`	affected	< e351cb2d373f6f1d4f1eb7c9f30dc058c69c89f8
`782a985d7af26db39e86070d28f987cad21313c0`	affected	< 18b3433f10ee9c69e3252046028aa2be421f2d4d
`782a985d7af26db39e86070d28f987cad21313c0`	affected	< 84829e324a396668ceafb14723293b2863a74dcf
`782a985d7af26db39e86070d28f987cad21313c0`	affected	< 3785d40831ba5601296283e0197e10e089392757

Linux

affected

Version	Status	Constraints
`3.16`	affected	—
`0`	unaffected	< 3.16
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.51`	unaffected	≤ 6.18.*
`7.2.5`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[782a985d7af26db39e86070d28f987cad21313c0,2239e6b49d33bb38817d69b4f0bf7d5cbde2ec68)`	affected	code_commit	—
`[782a985d7af26db39e86070d28f987cad21313c0,4a0236fe97732e31cb4a6dcb433642f9e3ef9a56)`	affected	code_commit	—
`[782a985d7af26db39e86070d28f987cad21313c0,e351cb2d373f6f1d4f1eb7c9f30dc058c69c89f8)`	affected	code_commit	—
`[782a985d7af26db39e86070d28f987cad21313c0,18b3433f10ee9c69e3252046028aa2be421f2d4d)`	affected	code_commit	—
`[782a985d7af26db39e86070d28f987cad21313c0,84829e324a396668ceafb14723293b2863a74dcf)`	affected	code_commit	—
`[782a985d7af26db39e86070d28f987cad21313c0,3785d40831ba5601296283e0197e10e089392757)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`3.16`	affected	generic	—
`[0,3.16)`	unaffected	semver	—
`[6.1.188,7.0.0)`	unaffected	semver	—
`[6.6.157,7.0.0)`	unaffected	semver	—
`[6.12.110,7.0.0)`	unaffected	semver	—
`[6.18.51,7.0.0)`	unaffected	semver	—
`[7.2.5,8.0.0)`	unaffected	semver	—
`[7.3-rc2,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.211% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/18b3433f10ee9c69e3252046028aa2be421f2d4d
https://git.kernel.org/stable/c/2239e6b49d33bb38817d69b4f0bf7d5cbde2ec68
https://git.kernel.org/stable/c/3785d40831ba5601296283e0197e10e089392757
https://git.kernel.org/stable/c/4a0236fe97732e31cb4a6dcb433642f9e3ef9a56
https://git.kernel.org/stable/c/84829e324a396668ceafb14723293b2863a74dcf
https://git.kernel.org/stable/c/e351cb2d373f6f1d4f1eb7c9f30dc058c69c89f8

History

Sep 18, 2026 9:30 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476

Sep 16, 2026 10:45 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/i915: Guard against NULL driver_data in i915_pci_probe() pci_match_device() can return the dummy pci_device_id_any entry when a device is force-bound via sysfs driver_override, in which case ->driver_data is unset (NULL). i915_pci_probe() casts it to struct intel_device_info * unconditionally and dereferences intel_info->require_force_probe, causing a NULL-ptr-deref. (cherry picked from commit 2727922084672cc274ecea726ea00363c2893731)
Title		drm/i915: Guard against NULL driver_data in i915_pci_probe()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/18b3433f10ee9c69e3252046028aa2be421f2d4d https://git.kernel.org/stable/c/2239e6b49d33bb38817d69b4f0bf7d5cbde2ec68 https://git.kernel.org/stable/c/3785d40831ba5601296283e0197e10e089392757 https://git.kernel.org/stable/c/4a0236fe97732e31cb4a6dcb433642f9e3ef9a56 https://git.kernel.org/stable/c/84829e324a396668ceafb14723293b2863a74dcf https://git.kernel.org/stable/c/e351cb2d373f6f1d4f1eb7c9f30dc058c69c89f8