CVE-2026-99146

What it actually does

Missing bounds validation on the DMC firmware header v3 start_mmioaddr field allows an attacker-controlled MMIO address to be passed directly to dmc_load_program() without the checks applied to the MMIO address table.

Why it matters to the business

Systems using Intel integrated graphics may experience kernel-level memory corruption or crashes if malicious or corrupted DMC firmware is loaded, increasing downtime and patching urgency for graphics-dependent workloads.

How an attack unfolds

An attacker crafts or supplies a DMC firmware image whose header version 3 contains an out-of-range start_mmioaddr value; when the driver loads the firmware the unchecked address is written via MMIO, bypassing hardware protections and enabling arbitrary memory access or denial of service.

How to fix it

Apply the upstream fix that adds the sanity check for dmc_info->start_mmioaddr against the valid MMIO range; rebuild and deploy the updated kernel package on all affected systems.

How to confirm the fix worked

Confirm the presence of the added range check in drm/i915/dmc.c (or equivalent) and verify that dmc_load_program() is only invoked after the new validation passes; test with both valid and deliberately malformed firmware headers.

Typical attack path

1. Obtain or generate a malicious DMC firmware blob with header version 3
2. Place the blob in a location read by the i915 driver (firmware search path or initramfs)
3. Trigger driver initialization or explicit DMC load on a system with the vulnerable kernel
4. Driver reads start_mmioaddr and passes it unvalidated to dmc_load_program()
5. Hardware performs the out-of-range MMIO write resulting in corruption or crash

How to detect it

Review kernel logs around i915 DMC initialization for address validation failures or unexpected MMIO faults; correlate with firmware load events and any subsequent system instability on Intel graphics hardware.

What your security team should do

• Immediately update Linux kernels to a version containing commit 5e47ee5c76ca or its backport
• Restrict write access to firmware directories used by the i915 driver
• Monitor graphics driver initialization logs for unexpected DMC load failures after patching
• Include the updated kernel in the next maintenance window for all Intel graphics hosts