CVE-2026-99118

drm/i915/dmc: Harden DMC firmware payload parsing

State: Published
Severity: Not scored
Published: Oct 28, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/dmc: Harden DMC firmware payload parsing

Validate the conversion of the DMC firmware size from dwords to bytes using check_mul_overflow() before calculating the firmware payload size.

Reject zero-length payloads and zero MMIO counts in the DMC firmware header so malformed firmware is caught early. Also set dmc_fw_size only after the payload allocation succeeds.

(cherry picked from commit efde6601a1f1daedfe3dcc2816c934ddb44e3eef)

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	eb805623d8b161342ed9c9caf366f0a295041a6d to before 0e396088fa5c1f96ff43de29c2a2f8807078723dAffected eb805623d8b161342ed9c9caf366f0a295041a6d to before 53068cf3851dd4e00e8e668563e0353d9d79a98bAffected eb805623d8b161342ed9c9caf366f0a295041a6d to before e33921271d4438f4a24014f560e5ab297d7eda3fAffected eb805623d8b161342ed9c9caf366f0a295041a6d to before 4589ad76a6b1011538600ad398baf0b7d73a1252Affected eb805623d8b161342ed9c9caf366f0a295041a6d to before eb7a0ba650d607976d1a0a5e7501d3f14b35d026Affected eb805623d8b161342ed9c9caf366f0a295041a6d to before dfcfe2874e7c16e8460dc86ac1eeb54ea0e7f8aaAffected eb805623d8b161342ed9c9caf366f0a295041a6d to before 05f7a2f712f8b287a98ee61a7c2c6b72dad2fc6dAffected eb805623d8b161342ed9c9caf366f0a295041a6d to before 8bb1858db453cd4250e3b633f5d2d09206024ca6Affected
LinuxLinux	4.2Affected before 4.2Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.161 through 6.6.Not affected 6.12.115 through 6.12.Not affected 6.18.59 through 6.18.Not affected 7.2.13 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

eb805623d8b161342ed9c9caf366f0a295041a6d to before 0e396088fa5c1f96ff43de29c2a2f8807078723dAffected
eb805623d8b161342ed9c9caf366f0a295041a6d to before 53068cf3851dd4e00e8e668563e0353d9d79a98bAffected
eb805623d8b161342ed9c9caf366f0a295041a6d to before e33921271d4438f4a24014f560e5ab297d7eda3fAffected
eb805623d8b161342ed9c9caf366f0a295041a6d to before 4589ad76a6b1011538600ad398baf0b7d73a1252Affected
eb805623d8b161342ed9c9caf366f0a295041a6d to before eb7a0ba650d607976d1a0a5e7501d3f14b35d026Affected
eb805623d8b161342ed9c9caf366f0a295041a6d to before dfcfe2874e7c16e8460dc86ac1eeb54ea0e7f8aaAffected
eb805623d8b161342ed9c9caf366f0a295041a6d to before 05f7a2f712f8b287a98ee61a7c2c6b72dad2fc6dAffected
eb805623d8b161342ed9c9caf366f0a295041a6d to before 8bb1858db453cd4250e3b633f5d2d09206024ca6Affected

LinuxLinux

4.2Affected
before 4.2Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.161 through 6.6.*Not affected
6.12.115 through 6.12.*Not affected
6.18.59 through 6.18.*Not affected
7.2.13 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.