Executive brief
The Intel i915 graphics driver in the Linux kernel can crash with a NULL pointer dereference when a device is force-bound through the sysfs driver override mechanism. This causes the driver probe function to crash and prevents normal system operation when attempting to use unsupported or manually configured graphics devices.
Technical details
This is a NULL pointer dereference vulnerability in the i915_pci_probe() function within the DRM (Direct Rendering Manager) i915 driver. When pci_match_device() returns the dummy pci_device_id_any entry (which occurs during force-binding via sysfs driver_override), the driver_data field remains unset (NULL). The probe function unconditionally casts this to struct intel_device_info* and immediately dereferences it to access intel_info->require_force_probe, causing a kernel crash. The attack vector requires local access to write to sysfs driver_override. A patch has been released that adds a NULL check before the dereference, returning -ENODEV if driver_data is NULL.
Affected products
- Linux Linux kernel multiple versions (patch applied across kernel versions 4.4.y through 6.9.y and rolling branches)
Timeline
- 2026-09-16: disclosed: CVE-2026-89822 published
- 2026-08-13: patched: Fix committed upstream by Deepanshu Kartikey
- 2026-09-11: patched: Patch included in stable kernel trees