CVE-2026-99006High· 7.8▾ Twilight

drm/i915/gem: Prevent overstepping exec array boundary

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for eb_relocate_parse_slow() to call kvfree() on entries outside the original exec array during f…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score43/ 100 · Moderate

impact 42.9 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Oct 23, 2026

Updated

Oct 24, 2026

CVSS

7.8

Vendor

Linux

Product

Linux

CWE

—

Depth score

43 · Moderate

EPSS

0.16% · p5

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Oct 24.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

5 events · 2 days

Oct 23, 2026Published
Disclosed via CVEORG
Oct 24, 2026Record revised
Last analysed / modified upstream
Oct 24, 2026EPSS first tracked
0.2%
Oct 24, 2026CVSS changed
— → 7.8
Oct 24, 2026Severity changed
none → high

Linux #cve.org

Affected

Linux >= 8e4ba491b0ba6fef69270d3c4e48fc517096ef41 < 24c04e80c35ff36947366f6deafddb522eea080c
Linux >= 8e4ba491b0ba6fef69270d3c4e48fc517096ef41 < b1c357131fc467c579f65e9a9d1fdc1a6273ae1d
Linux >= 8e4ba491b0ba6fef69270d3c4e48fc517096ef41 < 152fb5083b9333a1cb8629572f9e0f276a404ba6
Linux >= 8e4ba491b0ba6fef69270d3c4e48fc517096ef41 < 72d5cbb10d4916a3f8ef9da516c5c0634aca8439
Linux >= 8e4ba491b0ba6fef69270d3c4e48fc517096ef41 < ebe162db655881a38de43301151ff7ac940602b5
Linux 5.10

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/gem: Prevent overstepping exec array boundary

It is possible for eb_relocate_parse_slow() to call kvfree() on entries outside the original exec array during following scenario inside eb_relocate_parse_slow():

eb_copy_relocations() allocates as many as eb->buffer_count copies for exec entries;
eb_parse() appends up to two VMAs, right after incrementing eb->buffer_count;
cleanup under "out" label uses this incremented buffer_count to release relocation pointers from exec array via kvfree(), not from VMA array.

To amend this problem, ensure that relocation cleanup uses the original exec object count, excluding the VMAs appended by the command parser.

(cherry picked from commit 2a0158925fb943c7ba8f3216e2734952128defc9)

Affected

Linux >= 8e4ba491b0ba6fef69270d3c4e48fc517096ef41 < 24c04e80c35ff36947366f6deafddb522eea080c
Linux >= 8e4ba491b0ba6fef69270d3c4e48fc517096ef41 < b1c357131fc467c579f65e9a9d1fdc1a6273ae1d
Linux >= 8e4ba491b0ba6fef69270d3c4e48fc517096ef41 < 152fb5083b9333a1cb8629572f9e0f276a404ba6
Linux >= 8e4ba491b0ba6fef69270d3c4e48fc517096ef41 < 72d5cbb10d4916a3f8ef9da516c5c0634aca8439
Linux >= 8e4ba491b0ba6fef69270d3c4e48fc517096ef41 < ebe162db655881a38de43301151ff7ac940602b5
Linux 5.10

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Change history

Field changes observed since this record was first indexed.

Oct 24, 2026CVSS — → 7.8
Oct 24, 2026Severity none → high

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

drm/i915/gem: Prevent overstepping exec array boundary

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score43/ 100 · Moderate

impact 42.9 · likelihood 0 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/gem: Prevent overstepping exec array boundary

It is possible for eb_relocate_parse_slow() to call kvfree() on entries outside the original exec array during following scenario inside eb_relocate_parse_slow():

eb_copy_relocations() allocates as many as eb->buffer_count copies for exec entries;

eb_parse() appends up to two VMAs, right after incrementing eb->buffer_count;

cleanup under "out" label uses this incremented buffer_count to release relocation pointers from exec array via kvfree(), not from VMA array.

To amend this problem, ensure that relocation cleanup uses the original exec object count, excluding the VMAs appended by the command parser.

(cherry picked from commit 2a0158925fb943c7ba8f3216e2734952128defc9)

Affected

Linux >= 8e4ba491b0ba6fef69270d3c4e48fc517096ef41 < 24c04e80c35ff36947366f6deafddb522eea080c

Linux >= 8e4ba491b0ba6fef69270d3c4e48fc517096ef41 < b1c357131fc467c579f65e9a9d1fdc1a6273ae1d

Linux >= 8e4ba491b0ba6fef69270d3c4e48fc517096ef41 < 152fb5083b9333a1cb8629572f9e0f276a404ba6

Linux >= 8e4ba491b0ba6fef69270d3c4e48fc517096ef41 < 72d5cbb10d4916a3f8ef9da516c5c0634aca8439

Linux >= 8e4ba491b0ba6fef69270d3c4e48fc517096ef41 < ebe162db655881a38de43301151ff7ac940602b5

Linux 5.10