CVE-2026-99118

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99118", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.393Z", "datePublished": "2026-10-28T10:34:34.627Z", "dateUpdated": "2026-10-30T12:41:55.667Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:41:55.667Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/dmc: Harden DMC firmware payload parsing\n\nValidate the conversion of the DMC firmware size from dwords to bytes\nusing check_mul_overflow() before calculating the firmware payload size.\n\nReject zero-length payloads and zero MMIO counts in the DMC firmware\nheader so malformed firmware is caught early. Also set dmc_fw_size only\nafter the payload allocation succeeds.\n\n(cherry picked from commit efde6601a1f1daedfe3dcc2816c934ddb44e3eef)"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/i915/display/intel_dmc.c"], "versions": [{"version": "eb805623d8b161342ed9c9caf366f0a295041a6d", "lessThan": "0e396088fa5c1f96ff43de29c2a2f8807078723d", "status": "affected", "versionType": "git"}, {"version": "eb805623d8b161342ed9c9caf366f0a295041a6d", "lessThan": "53068cf3851dd4e00e8e668563e0353d9d79a98b", "status": "affected", "versionType": "git"}, {"version": "eb805623d8b161342ed9c9caf366f0a295041a6d", "lessThan": "e33921271d4438f4a24014f560e5ab297d7eda3f", "status": "affected", "versionType": "git"}, {"version": "eb805623d8b161342ed9c9caf366f0a295041a6d", "lessThan": "4589ad76a6b1011538600ad398baf0b7d73a1252", "status": "affected", "versionType": "git"}, {"version": "eb805623d8b161342ed9c9caf366f0a295041a6d", "lessThan": "eb7a0ba650d607976d1a0a5e7501d3f14b35d026", "status": "affected", "versionType": "git"}, {"version": "eb805623d8b161342ed9c9caf366f0a295041a6d", "lessThan": "dfcfe2874e7c16e8460dc86ac1eeb54ea0e7f8aa", "status": "affected", "versionType": "git"}, {"version": "eb805623d8b161342ed9c9caf366f0a295041a6d", "lessThan": "05f7a2f712f8b287a98ee61a7c2c6b72dad2fc6d", "status": "affected", "versionType": "git"}, {"version": "eb805623d8b161342ed9c9caf366f0a295041a6d", "lessThan": "8bb1858db453cd4250e3b633f5d2d09206024ca6", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/i915/display/intel_dmc.c"], "versions": [{"version": "4.2", "status": "affected"}, {"version": "0", "lessThan": "4.2", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.161", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.59", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.6.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.18.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0e396088fa5c1f96ff43de29c2a2f8807078723d"}, {"url": "https://git.kernel.org/stable/c/53068cf3851dd4e00e8e668563e0353d9d79a98b"}, {"url": "https://git.kernel.org/stable/c/e33921271d4438f4a24014f560e5ab297d7eda3f"}, {"url": "https://git.kernel.org/stable/c/4589ad76a6b1011538600ad398baf0b7d73a1252"}, {"url": "https://git.kernel.org/stable/c/eb7a0ba650d607976d1a0a5e7501d3f14b35d026"}, {"url": "https://git.kernel.org/stable/c/dfcfe2874e7c16e8460dc86ac1eeb54ea0e7f8aa"}, {"url": "https://git.kernel.org/stable/c/05f7a2f712f8b287a98ee61a7c2c6b72dad2fc6d"}, {"url": "https://git.kernel.org/stable/c/8bb1858db453cd4250e3b633f5d2d09206024ca6"}], "title": "drm/i915/dmc: Harden DMC firmware payload parsing", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/i915/display/intel_dmc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0e396088fa5c1f96ff43de29c2a2f8807078723d", "status": "affected", "version": "eb805623d8b161342ed9c9caf366f0a295041a6d", "versionType": "git"}, {"lessThan": "53068cf3851dd4e00e8e668563e0353d9d79a98b", "status": "affected", "version": "eb805623d8b161342ed9c9caf366f0a295041a6d", "versionType": "git"}, {"lessThan": "e33921271d4438f4a24014f560e5ab297d7eda3f", "status": "affected", "version": "eb805623d8b161342ed9c9caf366f0a295041a6d", "versionType": "git"}, {"lessThan": "4589ad76a6b1011538600ad398baf0b7d73a1252", "status": "affected", "version": "eb805623d8b161342ed9c9caf366f0a295041a6d", "versionType": "git"}, {"lessThan": "eb7a0ba650d607976d1a0a5e7501d3f14b35d026", "status": "affected", "version": "eb805623d8b161342ed9c9caf366f0a295041a6d", "versionType": "git"}, {"lessThan": "dfcfe2874e7c16e8460dc86ac1eeb54ea0e7f8aa", "status": "affected", "version": "eb805623d8b161342ed9c9caf366f0a295041a6d", "versionType": "git"}, {"lessThan": "05f7a2f712f8b287a98ee61a7c2c6b72dad2fc6d", "status": "affected", "version": "eb805623d8b161342ed9c9caf366f0a295041a6d", "versionType": "git"}, {"lessThan": "8bb1858db453cd4250e3b633f5d2d09206024ca6", "status": "affected", "version": "eb805623d8b161342ed9c9caf366f0a295041a6d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/i915/display/intel_dmc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.2"}, {"lessThan": "4.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.161", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.59", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/dmc: Harden DMC firmware payload parsing\n\nValidate the conversion of the DMC firmware size from dwords to bytes\nusing check_mul_overflow() before calculating the firmware payload size.\n\nReject zero-length payloads and zero MMIO counts in the DMC firmware\nheader so malformed firmware is caught early. Also set dmc_fw_size only\nafter the payload allocation succeeds.\n\n(cherry picked from commit efde6601a1f1daedfe3dcc2816c934ddb44e3eef)"}], "id": "CVE-2026-99118", "lastModified": "2026-10-30T13:21:46.257", "metrics": {}, "published": "2026-10-28T11:17:31.380", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/05f7a2f712f8b287a98ee61a7c2c6b72dad2fc6d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0e396088fa5c1f96ff43de29c2a2f8807078723d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4589ad76a6b1011538600ad398baf0b7d73a1252"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/53068cf3851dd4e00e8e668563e0353d9d79a98b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8bb1858db453cd4250e3b633f5d2d09206024ca6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dfcfe2874e7c16e8460dc86ac1eeb54ea0e7f8aa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e33921271d4438f4a24014f560e5ab297d7eda3f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eb7a0ba650d607976d1a0a5e7501d3f14b35d026"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/i915/dmc: Harden DMC firmware payload parsing", "id": "2562666", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562666"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/i915/dmc: Harden DMC firmware payload parsing\nValidate the conversion of the DMC firmware size from dwords to bytes\nusing check_mul_overflow() before calculating the firmware payload size.\nReject zero-length payloads and zero MMIO counts in the DMC firmware\nheader so malformed firmware is caught early. Also set dmc_fw_size only\nafter the payload allocation succeeds.\n(cherry picked from commit efde6601a1f1daedfe3dcc2816c934ddb44e3eef)", "A flaw was found in the Linux kernel's i915 graphics driver. When parsing Display Microcontroller (DMC) firmware images, the driver does not properly validate payload sizes or check for integer multiplication overflow during size calculations. A local user with the ability to supply a malformed firmware file could exploit this flaw, potentially leading to memory corruption or a Denial of Service (DoS) via a system crash."], "name": "CVE-2026-99118", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99118\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99118\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99118.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb805623d8b161342ed9c9caf366f0a295041a6d,dfcfe2874e7c16e8460dc86ac1eeb54ea0e7f8aa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb805623d8b161342ed9c9caf366f0a295041a6d,05f7a2f712f8b287a98ee61a7c2c6b72dad2fc6d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb805623d8b161342ed9c9caf366f0a295041a6d,8bb1858db453cd4250e3b633f5d2d09206024ca6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb805623d8b161342ed9c9caf366f0a295041a6d,dfcfe2874e7c16e8460dc86ac1eeb54ea0e7f8aa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb805623d8b161342ed9c9caf366f0a295041a6d,05f7a2f712f8b287a98ee61a7c2c6b72dad2fc6d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb805623d8b161342ed9c9caf366f0a295041a6d,8bb1858db453cd4250e3b633f5d2d09206024ca6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T12:00:22.514409+00:00", "updated": "2026-10-29T16:00:07.474941+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}