Linux Kernel i915 driver: Out-of-bounds memory release in GEM relocation handling
Summary
A flaw in the Intel i915 graphics driver of the Linux kernel allows the cleanup code in the relocation path to release memory outside the original exec object array. The cause is that the command parser appends up to two VMAs and increments the object count before the cleanup uses it. Conditions for exploitation are local access and a user able to submit GPU command buffers; the CVSS vector rates impact on confidentiality, integrity and availability as high.
Affected
- Linux kernel branches with commits from 8e4ba491b0ba6fef69270d3c4e48fc517096ef41 up to the respective fix commits (according to the CNA record)
- Linux 5.10 product line and later kernels up to the fixed stable releases, as listed in the OSV entry
- Exact affected ranges per stable branch: check the commit pages, as the sources are not fully consistent
Fixed in
- Stable fixes according to the OSV entry: 5.10.273, 5.15.224, 6.1.191, 6.6.160, 6.12.113, 6.18.57, 7.2.11
- Other branches: fixed by the stable commits listed in the references; the fixed version per branch is not confirmed by the sources
Workaround
Unknown.
Exploitation
- No reports of exploitation in the wild and no public proof of concept found at the time of research
- EPSS score 0.00163 (low)
- The fix patch is public on the intel-gfx mailing list, so the flaw is effectively disclosed
Our recommendation
- Install the kernel update from your distribution or the fixed stable kernel release once available
- Check whether your systems use Intel GPUs with the i915 driver
- Reboot after installing the kernel update to activate it
- Monitor vendor advisories, as some distributions still list the status as needs evaluation
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux kernel stable commit 24c04e80c35ff36947366f6deafddb522eea080c git.kernel.org
- Linux kernel stable commit ebe162db655881a38de43301151ff7ac940602b5 git.kernel.org
- Ubuntu security CVE-2026-99006 ubuntu.com
- SUSE CVE entry via Vulners vulners.com
- OSV Bell Alpaquita entry osv.dev
- Intel-gfx patch thread ratatoskr.run
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:30.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for eb_relocate_parse_slow() to call kvfree() on entries outside the original exec array during following scenario inside eb_relocate_parse_slow(): 1) eb_copy_relocations() allocates as many as eb->buffer_count copies for exec entries; 2) eb_parse() appends up to two VMAs, right after incrementing eb->buffer_count; 3) cleanup under "out" label uses this incremented buffer_count to release relocation pointers from exec array via kvfree(), not from VMA array. To amend this problem, ensure that relocation cleanup uses the original exec object count, excluding the VMAs appended by the command parser. (cherry picked from commit 2a0158925fb943c7ba8f3216e2734952128defc9)
NVD references (8)
- https://git.kernel.org/stable/c/152fb5083b9333a1cb8629572f9e0f276a404ba6
- https://git.kernel.org/stable/c/24c04e80c35ff36947366f6deafddb522eea080c
- https://git.kernel.org/stable/c/72d5cbb10d4916a3f8ef9da516c5c0634aca8439
- https://git.kernel.org/stable/c/7bed07cb4daa610cd6d92d9e72a575275a99ed54
- https://git.kernel.org/stable/c/859e52356f913806e5c1ee5d2022b7aeda0a784a
- https://git.kernel.org/stable/c/b1c357131fc467c579f65e9a9d1fdc1a6273ae1d
- https://git.kernel.org/stable/c/cf42a445bd5036c30d57ae65b041b8b17dfef7b0
- https://git.kernel.org/stable/c/ebe162db655881a38de43301151ff7ac940602b5
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.