CVE-2026-46216None▾ Sunlit

drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status()

In the Linux kernel, the following vulnerability has been resolved: drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status() When media GT is disabled via configfs, there is no allocation for media_gt, which is kept as…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

May 28, 2026

Updated

Nov 6, 2026

CVSS

—

Vendor

Linux

Product

Linux

CWE

—

Depth score

3 · Minimal

EPSS

0.13% · p2

Platforms

—

Source

CVEORG

Vector

—

CISA SSVC

decided 2026-11-06

Exploitation: none
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Nov 6.

0.1% → 0.1%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 162 days

May 28, 2026Published
Disclosed via CVEORG
Nov 6, 2026Record revised
Last analysed / modified upstream
Nov 6, 2026EPSS first tracked
0.1%

Linux #cve.org

Affected

Linux >= 4af50beb4e0f9e6aed9cd53436c099f1dba826f1 < cad210d2851f3a7d9573bdfc02aa61d9287bbe8c
Linux >= 4af50beb4e0f9e6aed9cd53436c099f1dba826f1 < 814326e86e929b865020ff44f4576dbdfe3f7ff3
Linux >= 4af50beb4e0f9e6aed9cd53436c099f1dba826f1 < d8ab4b47edf4578dbfbe5e95817107a514fa34cc
Linux >= 4af50beb4e0f9e6aed9cd53436c099f1dba826f1 < 60a1e131a811b68703da58fd805ab359b704ab03
Linux 6.10

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status()

When media GT is disabled via configfs, there is no allocation for media_gt, which is kept as NULL. In such scenario, intel_hdcp_gsc_check_status() results in a kernel pagefault error due to &gt->uc.gsc being evaluated as an invalid memory address.

Fix that by introducing a NULL check on media_gt and bailing out early if so.

While at it, also drop the NULL check for gsc, since it can't be NULL if media_gt is not NULL.

v2:

Get address for gsc only after checking that gt is not NULL. (Shuicheng)
Drop the NULL check for gsc. (Shuicheng) v3:
Add "Fixes" and "Cc: <stable...>" tags. (Matt)

(cherry picked from commit bfaf87e84ca3ca3f6e275f9ae56da47a8b55ffd1)

Affected

Linux >= 4af50beb4e0f9e6aed9cd53436c099f1dba826f1 < cad210d2851f3a7d9573bdfc02aa61d9287bbe8c
Linux >= 4af50beb4e0f9e6aed9cd53436c099f1dba826f1 < 814326e86e929b865020ff44f4576dbdfe3f7ff3
Linux >= 4af50beb4e0f9e6aed9cd53436c099f1dba826f1 < d8ab4b47edf4578dbfbe5e95817107a514fa34cc
Linux >= 4af50beb4e0f9e6aed9cd53436c099f1dba826f1 < 60a1e131a811b68703da58fd805ab359b704ab03
Linux 6.10

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status()

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status()

Fix that by introducing a NULL check on media_gt and bailing out early if so.

While at it, also drop the NULL check for gsc, since it can't be NULL if media_gt is not NULL.

v2:

Get address for gsc only after checking that gt is not NULL. (Shuicheng)

Drop the NULL check for gsc. (Shuicheng) v3:

Add "Fixes" and "Cc: <stable...>" tags. (Matt)

(cherry picked from commit bfaf87e84ca3ca3f6e275f9ae56da47a8b55ffd1)

Affected

Linux >= 4af50beb4e0f9e6aed9cd53436c099f1dba826f1 < cad210d2851f3a7d9573bdfc02aa61d9287bbe8c

Linux >= 4af50beb4e0f9e6aed9cd53436c099f1dba826f1 < 814326e86e929b865020ff44f4576dbdfe3f7ff3

Linux >= 4af50beb4e0f9e6aed9cd53436c099f1dba826f1 < d8ab4b47edf4578dbfbe5e95817107a514fa34cc

Linux >= 4af50beb4e0f9e6aed9cd53436c099f1dba826f1 < 60a1e131a811b68703da58fd805ab359b704ab03

Linux 6.10