CVE-2026-99118None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Harden DMC firmware payload parsing Validate the conversion of the DMC firmware size from dwords to bytes using check_mul_overflow() before calculating t…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/dmc: Harden DMC firmware payload parsing
Validate the conversion of the DMC firmware size from dwords to bytes using check_mul_overflow() before calculating the firmware payload size.
Reject zero-length payloads and zero MMIO counts in the DMC firmware header so malformed firmware is caught early. Also set dmc_fw_size only after the payload allocation succeeds.
(cherry picked from commit efde6601a1f1daedfe3dcc2816c934ddb44e3eef)
Linux >= eb805623d8b161342ed9c9caf366f0a295041a6d < dfcfe2874e7c16e8460dc86ac1eeb54ea0e7f8aaLinux >= eb805623d8b161342ed9c9caf366f0a295041a6d < 05f7a2f712f8b287a98ee61a7c2c6b72dad2fc6dLinux >= eb805623d8b161342ed9c9caf366f0a295041a6d < 8bb1858db453cd4250e3b633f5d2d09206024ca6Linux 4.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99116Nonenet: psp: do not inherit the Rx association on clone
CVE-2026-99117Nonenet: bridge: mcast: don't truncate the port group walk on teardown
CVE-2026-99121Noneipv4: avoid divide by zero in fib_rebalance
CVE-2026-99120NoneKVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
CVE-2026-99119Nonedrm/amdgpu/userq: actually validate userq BOs
CVE-2026-99123Nonevsock/virtio: validate packet source for connected sockets