CVE-2026-53356

drm/i915/gem: Fix phys BO pread/pwrite with offset

State: Published
Severity: 7.8 High
Published: Jul 1, 2026
Updated: Oct 19, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/gem: Fix phys BO pread/pwrite with offset

sg_page() returns struct page pointer not (void *) so the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO would be accessed if non-zero offset is used.

Last impacted platform with overlay or cursor planes using phys mapping was Gen3/945G/Lakeport.

(cherry picked from commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6)

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-1164 Irrelevant Code

Affected Products

Product	Versions
LinuxLinux	c6790dc22312f592c1434577258b31c48c72d52a to before 40f738991058eb3e3530c3006a5bd6fd5e29f035Affected c6790dc22312f592c1434577258b31c48c72d52a to before 1ec8fc63e9cdb22da54e48e536c9204020416fc6Affected c6790dc22312f592c1434577258b31c48c72d52a to before 14469860e2e39b7095dcd658d2bad38a11110a68Affected c6790dc22312f592c1434577258b31c48c72d52a to before 07c33be968d9e0cab6cba38c81850a09942fcb2eAffected c6790dc22312f592c1434577258b31c48c72d52a to before 3bd168dd835b93a3862cd05b0d13c432b115f9d6Affected c6790dc22312f592c1434577258b31c48c72d52a to before 32d4c5d328a3ff995420f4f85163e1e403f43628Affected c6790dc22312f592c1434577258b31c48c72d52a to before dd51a2eeb93bc6faa892ff9083911dd23f82c187Affected c6790dc22312f592c1434577258b31c48c72d52a to before d21ad938398bca695a511307de38a65889e3b354Affected
LinuxLinux	5.7Affected before 5.7Not affected 5.10.259 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.94 through 6.12.Not affected 6.18.36 through 6.18.Not affected 7.0.13 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

c6790dc22312f592c1434577258b31c48c72d52a to before 40f738991058eb3e3530c3006a5bd6fd5e29f035Affected
c6790dc22312f592c1434577258b31c48c72d52a to before 1ec8fc63e9cdb22da54e48e536c9204020416fc6Affected
c6790dc22312f592c1434577258b31c48c72d52a to before 14469860e2e39b7095dcd658d2bad38a11110a68Affected
c6790dc22312f592c1434577258b31c48c72d52a to before 07c33be968d9e0cab6cba38c81850a09942fcb2eAffected
c6790dc22312f592c1434577258b31c48c72d52a to before 3bd168dd835b93a3862cd05b0d13c432b115f9d6Affected
c6790dc22312f592c1434577258b31c48c72d52a to before 32d4c5d328a3ff995420f4f85163e1e403f43628Affected
c6790dc22312f592c1434577258b31c48c72d52a to before dd51a2eeb93bc6faa892ff9083911dd23f82c187Affected
c6790dc22312f592c1434577258b31c48c72d52a to before d21ad938398bca695a511307de38a65889e3b354Affected

LinuxLinux

5.7Affected
before 5.7Not affected
5.10.259 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.94 through 6.12.*Not affected
6.18.36 through 6.18.*Not affected
7.0.13 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.