Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-99118— drm/i915/dmc: Harden DMC firmware payload parsing

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： drm/i915/dmc：增强 DMC 固件载荷解析的安全性在计算固件载荷大小之前，使用函数验证将 DMC 固件大小从双字（dwords）转换为字节（bytes）的过程，以防止整数溢出。同时，拒绝长度为 0 的载荷以及 MMIO 计数为 0 的 DMC 固件头，从而尽早捕获畸形固件。此外，仅在载荷分配成功后才设置变量。（该修复源自提交 efde6601a1f1daedfe3dcc2816c934ddb44e3eef 的 cherry-pick）

AI Predicted 7.8 Difficulty: Hard EPSS 0.18% · P8 Updated Oct 30, 2026

Possible ATT&CK Techniques 2 AI

T1190 · Exploit Public-Facing Application T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 18

Vendor	Product	Version Range	Status
Linux	Linux	`eb805623d8b161342ed9c9caf366f0a295041a6d< 0e396088fa5c1f96ff43de29c2a2f8807078723d`	affected
		`eb805623d8b161342ed9c9caf366f0a295041a6d< 53068cf3851dd4e00e8e668563e0353d9d79a98b`	affected
		`eb805623d8b161342ed9c9caf366f0a295041a6d< e33921271d4438f4a24014f560e5ab297d7eda3f`	affected
		`eb805623d8b161342ed9c9caf366f0a295041a6d< 4589ad76a6b1011538600ad398baf0b7d73a1252`	affected
		`eb805623d8b161342ed9c9caf366f0a295041a6d< eb7a0ba650d607976d1a0a5e7501d3f14b35d026`	affected
		`eb805623d8b161342ed9c9caf366f0a295041a6d< dfcfe2874e7c16e8460dc86ac1eeb54ea0e7f8aa`	affected
		`eb805623d8b161342ed9c9caf366f0a295041a6d< 05f7a2f712f8b287a98ee61a7c2c6b72dad2fc6d`	affected
		`eb805623d8b161342ed9c9caf366f0a295041a6d< 8bb1858db453cd4250e3b633f5d2d09206024ca6`	affected
… +10 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

drm/i915/dmc: Harden DMC firmware payload parsing

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Harden DMC firmware payload parsing Validate the conversion of the DMC firmware size from dwords to bytes using check_mul_overflow() before calculating the firmware payload size. Reject zero-length payloads and zero MMIO counts in the DMC firmware header so malformed firmware is caught early. Also set dmc_fw_size only after the payload allocation succeeds. (cherry picked from commit efde6601a1f1daedfe3dcc2816c934ddb44e3eef)

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	eb805623d8b161342ed9c9caf366f0a295041a6d ~ 0e396088fa5c1f96ff43de29c2a2f8807078723d	-
Linux	Linux	4.2	-

II. Public POCs for CVE-2026-99118

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-99118

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99118 (8)

https://www.cve.org/CVERecord?id=CVE-2026-99118

Same Patch Batch · Linux · 2026-10-28 · 117 CVEs total

CVE-2026-99153	9.8 CRITICAL	scsi: libiscsi: Validate the ITT reflected in a Reject PDU
CVE-2026-99154	9.8 CRITICAL	scsi: libiscsi: Reject a negative task index from parse_pdu_itt
CVE-2026-99185	8.8 HIGH	firewire: core: fix race condition in split transaction handling
CVE-2026-99170	8.8 HIGH	namespace: a mount that copy_tree() leaves out can't take over a lock
CVE-2026-99216	8.4 HIGH	Drivers: hv: Don't reset VMBus connection state on error/exit paths
CVE-2026-99131	8.2 HIGH	xfs: fix capability check in xfs
CVE-2026-99163	7.8 HIGH	tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields
CVE-2026-99117	7.8 HIGH	net: bridge: mcast: don't truncate the port group walk on teardown
CVE-2026-99116	7.8 HIGH	net: psp: do not inherit the Rx association on clone
CVE-2026-99164	7.8 HIGH	spi: imx: fix slab corruption from undersized DMA bounce buffers
CVE-2026-99143	7.8 HIGH	tracing: Keep the predicate limit separate from program capacity
CVE-2026-99167	7.8 HIGH	net/sched: fix use-after-free in __tcf_action_put()
CVE-2026-99109	7.8 HIGH	smb: client: reject SetEA requests that do not fit the request buffer
CVE-2026-99177	7.8 HIGH	KVM: SEV: Fix page dirtying in sev_gmem_post_populate()
CVE-2026-99213	7.8 HIGH	vsock: treat TCP_CLOSING as once-established
CVE-2026-99173	7.8 HIGH	eventfs: Free the eventfs_inode after an rcu grace period too
CVE-2026-99203	7.8 HIGH	pipe: preserve existing fasync readers on writer setup failure
CVE-2026-99156	7.8 HIGH	scsi: st: Fix use-after-free race between st_remove() and st_open()
CVE-2026-99107	7.8 HIGH	ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize
CVE-2026-99180	7.8 HIGH	unicode: free the map after a grace period

Showing top 20 of 117 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux