Executive brief
A vulnerability was identified in the Linux kernel's Intel graphics driver (i915) affecting older hardware platforms. The issue involves incorrect memory addressing when reading or writing to specific graphics buffers, which could lead to accessing the wrong parts of system memory. This primarily impacts legacy systems using specific Intel Gen3 integrated graphics.
Technical details
A vulnerability in `drivers/gpu/drm/i915/gem/i915_gem_phys.c` stems from the misuse of `sg_page()`. The function returns a `struct page` pointer rather than a `void *` virtual address. When the driver performs pointer arithmetic to calculate an offset for `pread` or `pwrite` operations on physical Buffer Objects (BO), the scaling is incorrect because it is based on the size of the `page` structure rather than byte offsets. This causes the driver to access unintended memory locations when a non-zero offset is provided. The issue specifically affects legacy platforms like Gen3/945G/Lakeport that utilize physical mappings for overlay or cursor planes. Patches have been backported to multiple stable kernel branches.
Affected products
- Linux Linux Kernel v4.5 to 6.13.y
Timeline
- 2026-06-10: disclosed: Initial patch submitted by Joonas Lahtinen
- 2026-06-19: patched: Commits merged into stable trees by Greg Kroah-Hartman
- 2026-07-01: advisory: CVE-2026-53356 published
References
- https://git.kernel.org/stable/c/07c33be968d9e0cab6cba38c81850a09942fcb2e
- https://git.kernel.org/stable/c/14469860e2e39b7095dcd658d2bad38a11110a68
- https://git.kernel.org/stable/c/1ec8fc63e9cdb22da54e48e536c9204020416fc6
- https://git.kernel.org/stable/c/32d4c5d328a3ff995420f4f85163e1e403f43628
- https://git.kernel.org/stable/c/3bd168dd835b93a3862cd05b0d13c432b115f9d6
- https://git.kernel.org/stable/c/40f738991058eb3e3530c3006a5bd6fd5e29f035
- https://git.kernel.org/stable/c/d21ad938398bca695a511307de38a65889e3b354