---
id: CVE-2026-99146
title: 'drm/i915/dmc: Add sanity check for DMC load address'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/i915/dmc: Add sanity check for DMC load address

  For DMC firmware header version 3, the firmware load address is stored
  in dmc_info->start_mmioaddr and later used b…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 3d5928a168a9546b23c6b3439c6158d7a028326c <
    ef82b4d5cb4a3fe77c7f99008d78b8c64709e258
  - >-
    Linux >= 3d5928a168a9546b23c6b3439c6158d7a028326c <
    2fbd099b4e7c8c4ff70033c5bb950cdbb20838e2
  - >-
    Linux >= 3d5928a168a9546b23c6b3439c6158d7a028326c <
    7dedc5bb11f95e96fe80757c924d8d9aa7327759
  - Linux 5.15
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T10:35:02.847Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99146'
references:
  - url: 'https://git.kernel.org/stable/c/ef82b4d5cb4a3fe77c7f99008d78b8c64709e258'
  - url: 'https://git.kernel.org/stable/c/2fbd099b4e7c8c4ff70033c5bb950cdbb20838e2'
  - url: 'https://git.kernel.org/stable/c/7dedc5bb11f95e96fe80757c924d8d9aa7327759'
tags:
  - cve.org
ingestedAt: '2026-10-28T11:09:40.412Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/dmc: Add sanity check for DMC load address

For DMC firmware header version 3, the firmware load address is stored
in dmc_info->start_mmioaddr and later used by dmc_load_program().

Unlike the MMIO address table, the firmware load address is not
validated. Add a sanity check to ensure it is within the valid range.

BSpec: 69671, 68378
(cherry picked from commit 5e47ee5c76ca9becde8df4ad5202845b7ffcbc4c)

## Affected

- `Linux >= 3d5928a168a9546b23c6b3439c6158d7a028326c < ef82b4d5cb4a3fe77c7f99008d78b8c64709e258`
- `Linux >= 3d5928a168a9546b23c6b3439c6158d7a028326c < 2fbd099b4e7c8c4ff70033c5bb950cdbb20838e2`
- `Linux >= 3d5928a168a9546b23c6b3439c6158d7a028326c < 7dedc5bb11f95e96fe80757c924d8d9aa7327759`
- `Linux 5.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.