CVE-2026-43368
Integer Overflow in Linux Kernel i915 Driver
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| intel | linux_kernel | * |
| intel | linux_kernel | 6.17.0-rc1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's drm/i915 driver, specifically related to the handling of scatterlists for GEM shmem objects.
When a scatterlist table for a GEM shmem object reaches or exceeds 4 GB in size, the unsigned int length attribute of a scatterlist can overflow. This overflow occurs because the total byte length of pages allocated to a single scatterlist crosses the 4 GB limit.
As a result, users of the object may experience an unexpected and premature end of the object's backing pages, potentially causing issues in memory management or GPU operations.
The vulnerability was introduced by a previous change and was noted but not fixed until this update, which ensures that the byte length of any single scatterlist does not exceed the maximum segment size.
How can this vulnerability impact me? :
This vulnerability can cause an overflow in the scatterlist length attribute, leading to an unexpected premature end of the backing pages for a GEM shmem object.
Such an overflow may result in memory management errors or instability in GPU-related operations that rely on these scatterlists.
In practical terms, this could cause system crashes, data corruption, or unexpected behavior in applications using the affected graphics driver.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability may be detected by monitoring kernel logs for specific warning messages related to the i915 driver. Look for warnings indicating a potential overflow in the scatterlist length, such as messages containing 'WARNING: CPU' and references to 'remap_sg' in the i915 driver.
You can use the following command to check the kernel log for such warnings:
- dmesg | grep -i 'WARNING.*i915'
- journalctl -k | grep -i 'WARNING.*i915'
These commands search for warning messages in the kernel logs that may indicate the presence of this vulnerability being triggered.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version that includes the fix for the overflow of the shmem scatterlist length in the i915 driver.
The fix ensures that when adding folio pages to a scatterlist table, the byte length of any single scatterlist does not exceed the maximum segment size, preventing overflow.
Until the kernel is updated, monitor kernel logs for warning messages related to this issue and avoid workloads that may allocate scatterlists of 4 GB or more in size.