CVE-2026-99006

What it actually does

Use-after-free style memory corruption in eb_relocate_parse_slow() where kvfree() is called on pointers beyond the original exec array after eb_parse() increments buffer_count by appending VMAs.

Why it matters to the business

Local attackers on systems with Intel graphics can achieve kernel memory corruption, enabling privilege escalation or denial of service; the flaw affects recent mainline kernels and requires prompt patching given its presence in the graphics subsystem.

How an attack unfolds

An attacker invokes the i915 execbuffer ioctl with crafted relocation entries that force the slow path; eb_copy_relocations allocates copies, eb_parse appends VMAs and increments buffer_count, then cleanup under the out label performs kvfree on the wrong range, corrupting kernel memory structures.

How to fix it

Apply the upstream fix from commit 2a0158925fb943c7ba8f3216e2734952128defc9 or later kernels that use the original exec object count for relocation cleanup; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the cherry-picked commit or equivalent change is present in the running kernel source; exercise drm execbuffer paths under stress and verify no invalid kvfree occurs.

Typical attack path

1. Open a DRM fd and prepare an execbuffer with relocation arrays sized to trigger eb_relocate_parse_slow
2. Trigger eb_copy_relocations to duplicate exec entries
3. Force eb_parse to append up to two VMAs and increment buffer_count
4. Cause cleanup path to kvfree entries using the inflated count
5. Leverage resulting memory corruption for privilege escalation or crash

How to detect it

Inspect kernel logs for i915 or drm relocation related faults, oops involving eb_relocate_parse_slow or kvfree on exec arrays; correlate with processes using i915 GEM execbuffer ioctls.

What your security team should do

• Prioritize kernel updates on all Intel GPU systems within the next patch cycle
• Restrict unprivileged access to DRM render nodes where feasible
• Monitor for kernel oops or memory corruption reports involving i915 gem relocation functions