247 lines
14 KiB
JSON
247 lines
14 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-43368",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-05-01T14:12:56.005Z",
|
|
"datePublished": "2026-05-08T14:21:20.500Z",
|
|
"dateUpdated": "2026-10-19T19:16:27.757Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T12:27:31.468Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: Fix potential overflow of shmem scatterlist length\n\nWhen a scatterlists table of a GEM shmem object of size 4 GB or more is\npopulated with pages allocated from a folio, unsigned int .length\nattribute of a scatterlist may get overflowed if total byte length of\npages allocated to that single scatterlist happens to reach or cross the\n4GB limit. As a consequence, users of the object may suffer from hitting\nunexpected, premature end of the object's backing pages.\n\n[278.780187] ------------[ cut here ]------------\n[278.780377] WARNING: CPU: 1 PID: 2326 at drivers/gpu/drm/i915/i915_mm.c:55 remap_sg+0x199/0x1d0 [i915]\n...\n[278.780654] CPU: 1 UID: 0 PID: 2326 Comm: gem_mmap_offset Tainted: G S U 6.17.0-rc1-CI_DRM_16981-ged823aaa0607+ #1 PREEMPT(voluntary)\n[278.780656] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER\n[278.780658] Hardware name: Intel Corporation Meteor Lake Client Platform/MTL-P LP5x T3 RVP, BIOS MTLPFWI1.R00.3471.D91.2401310918 01/31/2024\n[278.780659] RIP: 0010:remap_sg+0x199/0x1d0 [i915]\n...\n[278.780786] Call Trace:\n[278.780787] <TASK>\n[278.780788] ? __apply_to_page_range+0x3e6/0x910\n[278.780795] ? __pfx_remap_sg+0x10/0x10 [i915]\n[278.780906] apply_to_page_range+0x14/0x30\n[278.780908] remap_io_sg+0x14d/0x260 [i915]\n[278.781013] vm_fault_cpu+0xd2/0x330 [i915]\n[278.781137] __do_fault+0x3a/0x1b0\n[278.781140] do_fault+0x322/0x640\n[278.781143] __handle_mm_fault+0x938/0xfd0\n[278.781150] handle_mm_fault+0x12c/0x300\n[278.781152] ? lock_mm_and_find_vma+0x4b/0x760\n[278.781155] do_user_addr_fault+0x2d6/0x8e0\n[278.781160] exc_page_fault+0x96/0x2c0\n[278.781165] asm_exc_page_fault+0x27/0x30\n...\n\nThat issue was apprehended by the author of a change that introduced it,\nand potential risk even annotated with a comment, but then never addressed.\n\nWhen adding folio pages to a scatterlist table, take care of byte length\nof any single scatterlist not exceeding max_segment.\n\n(cherry picked from commit 06249b4e691a75694c014a61708c007fb5755f60)"
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The vulnerable i915 GEM shmem path is reached through local DRM ioctls and mmap faults on an i915 render device, not via network or adjacent protocols.\nAC:L - An attacker can create a large GEM object and fault/bind it through normal i915 paths; there is no race or victim-controlled timing requirement, and uncertainty about allocator state is scored toward the higher-severity low-complexity value.\nPR:L - The relevant GEM create and mmap ioctls are marked DRM_RENDER_ALLOW and are reachable by a local user with render-node access, without CAP_SYS_ADMIN or DRM master privileges.\nUI:N - No victim action is required after the attacker has local access to the DRM device; the attacker triggers object creation, page population, and mmap/GPU use directly.\nS:U - The impact remains within the kernel/i915 security authority and does not cross a VM, IOMMU, or separate administrative boundary by itself.\nC:H - The overflow corrupts scatterlist length metadata for a user-controlled large object, and later i915 CPU/GPU mapping paths can consume the truncated table and potentially walk/use attacker-groomable scatterlist metadata. Under the required uncertainty rule, this is treated as a high-impact kernel/GPU memory disclosure primitive.\nI:H - The malformed scatterlist can feed GPU page-table or remapping paths with incorrect DMA addresses, plausibly allowing writes through GPU mappings to unintended memory. Under the required uncertainty rule, this is treated as high integrity impact.\nA:H - At minimum the bug can cause premature scatterlist termination leading to kernel warnings/errors, BUG/OOPS-class failures, GPU faults, hangs, or very large unreleased backing-page leaks when triggered repeatedly."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/gpu/drm/i915/gem/i915_gem_shmem.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "0b62af28f249b9c4036a05acfb053058dc02e2e2",
|
|
"lessThan": "aeb7255531ba4a5c3a64938577170d08b78de399",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "0b62af28f249b9c4036a05acfb053058dc02e2e2",
|
|
"lessThan": "1c956f0fccc26fefcbb507516c49d1db41c40471",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "0b62af28f249b9c4036a05acfb053058dc02e2e2",
|
|
"lessThan": "eae4bf4107571283031db96ce132e951615e2ae4",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "0b62af28f249b9c4036a05acfb053058dc02e2e2",
|
|
"lessThan": "21a301f12d18797bf889c15497f922edfdaece3a",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "0b62af28f249b9c4036a05acfb053058dc02e2e2",
|
|
"lessThan": "029ae067431ab9d0fca479bdabe780fa436706ea",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/gpu/drm/i915/gem/i915_gem_shmem.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.5",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.5",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.130",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.78",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.19",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.19.9",
|
|
"lessThanOrEqual": "6.19.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.0",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.5",
|
|
"versionEndExcluding": "6.6.130"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.5",
|
|
"versionEndExcluding": "6.12.78"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.5",
|
|
"versionEndExcluding": "6.18.19"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.5",
|
|
"versionEndExcluding": "6.19.9"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.5",
|
|
"versionEndExcluding": "7.0"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/aeb7255531ba4a5c3a64938577170d08b78de399"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/1c956f0fccc26fefcbb507516c49d1db41c40471"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/eae4bf4107571283031db96ce132e951615e2ae4"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/21a301f12d18797bf889c15497f922edfdaece3a"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/029ae067431ab9d0fca479bdabe780fa436706ea"
|
|
}
|
|
],
|
|
"title": "drm/i915: Fix potential overflow of shmem scatterlist length",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2026-43368",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2026-10-16T15:16:50.049391Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"type": "CWE",
|
|
"cweId": "CWE-190",
|
|
"description": "CWE-190 Integer Overflow or Wraparound"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-10-19T19:16:27.757Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |