# CVE-2026-99146: Linux kernel i915 DMC firmware load address validation bypass

Source: https://junglewise.ai/threats/cve-2026-99146-in-the-linux-kernel-the-following-vulnerability-has-been-resolved  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-99146 · Severity: info · Published 2026-10-28

The Linux kernel's Intel graphics driver (i915) failed to validate firmware load addresses for Display and Memory Controller (DMC) firmware in header version 3, allowing invalid addresses to be used. An attacker with the ability to provide malicious DMC firmware could potentially cause a system crash or memory corruption, affecting systems using Intel integrated graphics.

Technologies: [Unknown Linux kernel](https://junglewise.ai/threats/technologies/unknown-linux-kernel). Vendors: [Unknown](https://junglewise.ai/threats/vendors/unknown).

## Quick answers

**Is CVE-2026-99146 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-99146 being exploited in the wild.

**How severe is CVE-2026-99146?** Informational severity, published 28 October 2026.

**Which products and versions are affected?** Unknown Linux kernel Header version 3 DMC firmware affected; fix in commit 7dedc5bb11f95e96fe80757c924d8d9aa7327759.

**Is there a fix for CVE-2026-99146?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-99146 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-99146?** Check whether you run Unknown Linux kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing sanity check in the drm/i915 display driver allows DMC firmware (header version 3) to specify load addresses outside valid memory ranges. The vulnerability exists in the parse_dmc_fw_header() function which processes firmware headers but does not validate the start_mmioaddr field before passing it to dmc_load_program(). An attacker must be able to supply a malicious DMC firmware binary, either through local modification or supply-chain compromise. The fix adds dmc_load_addr_sanity_check() to validate addresses are within defined program base ranges.

## Affected products

- <UNKNOWN> Linux kernel Header version 3 DMC firmware affected; fix in commit 7dedc5bb11f95e96fe80757c924d8d9aa7327759

## Timeline

- 2026-10-28: disclosed

## References

- [https://git.kernel.org/stable/c/2fbd099b4e7c8c4ff70033c5bb950cdbb20838e2](https://git.kernel.org/stable/c/2fbd099b4e7c8c4ff70033c5bb950cdbb20838e2)
- [https://git.kernel.org/stable/c/7dedc5bb11f95e96fe80757c924d8d9aa7327759](https://git.kernel.org/stable/c/7dedc5bb11f95e96fe80757c924d8d9aa7327759)

## Related threats

- [Linux kernel netfilter nft_byteorder multi-register bypass](https://junglewise.ai/threats/cve-2026-99285-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel GPIO null pointer dereference in shared GPIO lookup](https://junglewise.ai/threats/cve-2026-99257-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel NTFS race condition in page fault handler](https://junglewise.ai/threats/cve-2026-99241-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel dm-integrity buffer overflow in inline mode](https://junglewise.ai/threats/cve-2026-99098-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel GVE XSK buffer memory leak when stopping rings](https://junglewise.ai/threats/cve-2026-99047-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)