AZL-111275: CVE-2026-99146 affecting package kernel 6.6.157.1-1

Q: Which systems are exposed to this issue?

The affected software identified here is the Azure Linux kernel package version 6.6.157.1-1. The vulnerable code is in the Intel i915 DRM DMC firmware-loading path.

Q: What is required to trigger the vulnerability?

The issue involves a DMC firmware header version 3 whose firmware load address is later used without validation. The provided data does not specify how an attacker could supply or influence that firmware.

Q: What is the remediation?

Use a kernel package that includes the added sanity check validating the DMC firmware load address against the valid range. The provided data does not identify the first fixed package version.

Published Oct 28, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/dmc: Add sanity check for DMC load address

For DMC firmware header version 3, the firmware load address is stored in dmcinfo->startmmioaddr and later used by dmcloadprogram().

Unlike the MMIO address table, the firmware load address is not validated. Add a sanity check to ensure it is within the valid range.

BSpec: 69671, 68378 (cherry picked from commit 5e47ee5c76ca9becde8df4ad5202845b7ffcbc4c)

Affected Software

1 affected component

azure-linux/kernel<=6.6.157.1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade kernel to a version that resolves this vulnerability.
Patch 5e47ee5c76ca9becde8df4ad5202845b7ffcbc4c

Event History

Oct 28, 2026

Advisory Published

via OSV·11:17 AM

Data Sourced

via OSV·11:17 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-99146

Frequently Asked Questions

Which systems are exposed to this issue?

The affected software identified here is the Azure Linux kernel package version 6.6.157.1-1. The vulnerable code is in the Intel i915 DRM DMC firmware-loading path.

What is required to trigger the vulnerability?

The issue involves a DMC firmware header version 3 whose firmware load address is later used without validation. The provided data does not specify how an attacker could supply or influence that firmware.

What is the remediation?

Use a kernel package that includes the added sanity check validating the DMC firmware load address against the valid range. The provided data does not identify the first fixed package version.

AZL-111275: CVE-2026-99146 affecting package kernel 6.6.157.1-1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems are exposed to this issue?

What is required to trigger the vulnerability?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What is required to trigger the vulnerability?

What is the remediation?