Cloudanix VulnDB

CVE-2026-99118

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in how the Linux kernel checks graphics firmware files could let bad data cause crashes on computers with Intel graphics until the system is updated.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability is improper input validation in Linux kernel DMC firmware header parsing that permitted zero-length payloads, zero MMIO counts, and unchecked dword-to-byte size conversions, allowing malformed firmware to reach allocation or MMIO logic.

Why it matters to the business

Systems with Intel i915 graphics may experience kernel instability or crashes when loading untrusted or corrupted DMC firmware, increasing downtime and patch urgency for organizations running recent kernels.

How an attack unfolds

An attacker supplies a crafted DMC firmware image containing invalid header fields; the kernel performs an unchecked size conversion and proceeds to allocate or process the payload, triggering memory corruption or denial of service.

How to fix it

Apply the upstream fix that adds check_mul_overflow validation, rejects zero-length payloads and zero MMIO counts, and sets firmware size only after successful allocation. Reboot after updating the kernel package.

How to confirm the fix worked

Confirm the running kernel contains commit efde6601a1f1 or equivalent backport; attempt to load a test firmware with zero-length payload and verify it is rejected before allocation.

Typical attack path

  1. Obtain or generate a malformed DMC firmware binary with zero payload length or zero MMIO count
  2. Place the firmware in a location searched by the i915 driver
  3. Trigger driver initialization or explicit firmware load on an affected kernel
  4. Kernel performs unchecked conversion and processes the invalid header, leading to crash or corruption

How to detect it

Review kernel logs for DMC firmware load failures or warnings around size conversion; inspect any custom or sideloaded firmware images present on disk for anomalous header values.

What your security team should do

  • Prioritize kernel updates on all systems using i915 graphics within the next patching cycle
  • Monitor vendor advisories for distribution-specific backports
  • Restrict unprivileged firmware loading where possible until patched

The record

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Harden DMC firmware payload parsing Validate the conversion of the DMC firmware size from dwords to bytes using check_mul_overflow() before calculating the firmware payload size. Reject zero-length payloads and zero MMIO counts in the DMC firmware header so malformed firmware is caught early. Also set dmc_fw_size only after the payload allocation succeeds. (cherry picked from commit efde6601a1f1daedfe3dcc2816c934ddb44e3eef)

Affected packages

Ecosystem Package Introduced Fixed