CVE-2026-99146

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99146", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.396Z", "datePublished": "2026-10-28T10:35:02.847Z", "dateUpdated": "2026-11-10T18:15:25.826Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-10T18:15:25.826Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/dmc: Add sanity check for DMC load address\n\nFor DMC firmware header version 3, the firmware load address is stored\nin dmc_info->start_mmioaddr and later used by dmc_load_program().\n\nUnlike the MMIO address table, the firmware load address is not\nvalidated. Add a sanity check to ensure it is within the valid range.\n\nBSpec: 69671, 68378\n(cherry picked from commit 5e47ee5c76ca9becde8df4ad5202845b7ffcbc4c)"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/i915/display/intel_dmc.c", "drivers/gpu/drm/i915/display/intel_dmc_regs.h"], "versions": [{"version": "3d5928a168a9546b23c6b3439c6158d7a028326c", "lessThan": "fe48b4c48d4131192a10bc6ea526a8a36b345501", "status": "affected", "versionType": "git"}, {"version": "3d5928a168a9546b23c6b3439c6158d7a028326c", "lessThan": "ef82b4d5cb4a3fe77c7f99008d78b8c64709e258", "status": "affected", "versionType": "git"}, {"version": "3d5928a168a9546b23c6b3439c6158d7a028326c", "lessThan": "2fbd099b4e7c8c4ff70033c5bb950cdbb20838e2", "status": "affected", "versionType": "git"}, {"version": "3d5928a168a9546b23c6b3439c6158d7a028326c", "lessThan": "7dedc5bb11f95e96fe80757c924d8d9aa7327759", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/i915/display/intel_dmc.c", "drivers/gpu/drm/i915/display/intel_dmc_regs.h"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.117", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.59", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.117"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fe48b4c48d4131192a10bc6ea526a8a36b345501"}, {"url": "https://git.kernel.org/stable/c/ef82b4d5cb4a3fe77c7f99008d78b8c64709e258"}, {"url": "https://git.kernel.org/stable/c/2fbd099b4e7c8c4ff70033c5bb950cdbb20838e2"}, {"url": "https://git.kernel.org/stable/c/7dedc5bb11f95e96fe80757c924d8d9aa7327759"}], "title": "drm/i915/dmc: Add sanity check for DMC load address", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/i915/display/intel_dmc.c", "drivers/gpu/drm/i915/display/intel_dmc_regs.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fe48b4c48d4131192a10bc6ea526a8a36b345501", "status": "affected", "version": "3d5928a168a9546b23c6b3439c6158d7a028326c", "versionType": "git"}, {"lessThan": "ef82b4d5cb4a3fe77c7f99008d78b8c64709e258", "status": "affected", "version": "3d5928a168a9546b23c6b3439c6158d7a028326c", "versionType": "git"}, {"lessThan": "2fbd099b4e7c8c4ff70033c5bb950cdbb20838e2", "status": "affected", "version": "3d5928a168a9546b23c6b3439c6158d7a028326c", "versionType": "git"}, {"lessThan": "7dedc5bb11f95e96fe80757c924d8d9aa7327759", "status": "affected", "version": "3d5928a168a9546b23c6b3439c6158d7a028326c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/i915/display/intel_dmc.c", "drivers/gpu/drm/i915/display/intel_dmc_regs.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.117", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.59", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/dmc: Add sanity check for DMC load address\n\nFor DMC firmware header version 3, the firmware load address is stored\nin dmc_info->start_mmioaddr and later used by dmc_load_program().\n\nUnlike the MMIO address table, the firmware load address is not\nvalidated. Add a sanity check to ensure it is within the valid range.\n\nBSpec: 69671, 68378\n(cherry picked from commit 5e47ee5c76ca9becde8df4ad5202845b7ffcbc4c)"}], "id": "CVE-2026-99146", "lastModified": "2026-11-10T19:22:30.757", "metrics": {}, "published": "2026-10-28T11:17:34.660", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2fbd099b4e7c8c4ff70033c5bb950cdbb20838e2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7dedc5bb11f95e96fe80757c924d8d9aa7327759"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ef82b4d5cb4a3fe77c7f99008d78b8c64709e258"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fe48b4c48d4131192a10bc6ea526a8a36b345501"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via unvalidated DMC firmware load address in i915 driver", "id": "2562773", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562773"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1285", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/i915/dmc: Add sanity check for DMC load address\nFor DMC firmware header version 3, the firmware load address is stored\nin dmc_info->start_mmioaddr and later used by dmc_load_program().\nUnlike the MMIO address table, the firmware load address is not\nvalidated. Add a sanity check to ensure it is within the valid range.\nBSpec: 69671, 68378\n(cherry picked from commit 5e47ee5c76ca9becde8df4ad5202845b7ffcbc4c)", "A flaw was found in the Linux kernel's Intel i915 graphics driver. When parsing Display Microcontroller (DMC) firmware headers, the driver fails to validate the target load address against allowed memory ranges. An attacker capable of supplying a crafted firmware file could exploit this vulnerability to perform invalid hardware register writes, potentially resulting in system instability or a Denial of Service (DoS)."], "name": "CVE-2026-99146", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-28T10:35:02Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99146\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99146\nhttps://git.kernel.org/stable/c/2fbd099b4e7c8c4ff70033c5bb950cdbb20838e2\nhttps://git.kernel.org/stable/c/7dedc5bb11f95e96fe80757c924d8d9aa7327759\nhttps://git.kernel.org/stable/c/ef82b4d5cb4a3fe77c7f99008d78b8c64709e258"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3d5928a168a9546b23c6b3439c6158d7a028326c,ef82b4d5cb4a3fe77c7f99008d78b8c64709e258)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3d5928a168a9546b23c6b3439c6158d7a028326c,2fbd099b4e7c8c4ff70033c5bb950cdbb20838e2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3d5928a168a9546b23c6b3439c6158d7a028326c,7dedc5bb11f95e96fe80757c924d8d9aa7327759)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3d5928a168a9546b23c6b3439c6158d7a028326c,ef82b4d5cb4a3fe77c7f99008d78b8c64709e258)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3d5928a168a9546b23c6b3439c6158d7a028326c,2fbd099b4e7c8c4ff70033c5bb950cdbb20838e2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3d5928a168a9546b23c6b3439c6158d7a028326c,7dedc5bb11f95e96fe80757c924d8d9aa7327759)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T12:15:14.881244+00:00", "updated": "2026-10-30T05:30:09.653496+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}