Executive brief
A vulnerability in the Intel i915 graphics driver within the Linux kernel could allow a local user to cause system instability or potentially access restricted memory. This occurs when the system handles very large memory objects (4GB or larger) used by the graphics processor, leading to an internal counter overflow. An exploit could result in a system crash or unauthorized data access, impacting the reliability and security of affected workstations and servers.
Technical details
An integer overflow exists in the 'drm/i915' driver's handling of scatterlist tables for GEM shmem objects. When a GEM shmem object of 4GB or larger is populated with pages from a folio, the 'unsigned int .length' attribute of a scatterlist can overflow if the total byte length reaches or exceeds the 4GB limit. This root cause is located in 'shmem_sg_alloc_table' within 'drivers/gpu/drm/i915/gem/i915_gem_shmem.c'. A local attacker can trigger this by allocating large graphics buffers, leading to a premature end of the object's backing pages and subsequent memory corruption or kernel warnings (e.g., in 'remap_sg'). The issue is resolved by ensuring single scatterlist lengths do not exceed 'max_segment'.
Affected products
- Linux Linux kernel v6.5+
Timeline
- 2026-02-24: other: Patch authored
- 2026-05-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/029ae067431ab9d0fca479bdabe780fa436706ea
- https://git.kernel.org/stable/c/1c956f0fccc26fefcbb507516c49d1db41c40471
- https://git.kernel.org/stable/c/21a301f12d18797bf889c15497f922edfdaece3a
- https://git.kernel.org/stable/c/aeb7255531ba4a5c3a64938577170d08b78de399
- https://git.kernel.org/stable/c/eae4bf4107571283031db96ce132e951615e2ae4