CVE-2026-89822: drm/i915: Guard against NULL driver_data in i915_pci_probe()
In the Linux kernel, the following vulnerability has been resolved:
drm/i915: Guard against NULL driverdata in i915pciprobe()
pcimatchdevice() can return the dummy pcideviceidany entry when a device is force-bound via sysfs driveroverride, in which case ->driverdata is unset (NULL). i915pciprobe() casts it to struct inteldeviceinfo unconditionally and dereferences intelinfo->requireforceprobe, causing a NULL-ptr-deref.
(cherry picked from commit 2727922084672cc274ecea726ea00363c2893731)
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel i915 DRM driver are exposed when a PCI device is force-bound to i915 through the sysfs driver_override mechanism.
What must an attacker or local user do to trigger the failure?
They must force-bind a device through sysfs driver_override so that pci_match_device() returns the dummy pci_device_id_any entry, which has no driver_data. The i915 probe path then dereferences the resulting NULL device-information pointer.
Is this triggered during normal i915 device matching?
The described NULL pointer condition occurs specifically when force-binding via sysfs driver_override causes the dummy PCI match entry to be returned. The provided information does not indicate that normal matching produces this condition.
What is the impact of a successful trigger?
The affected probe path can dereference a NULL pointer, resulting in a kernel NULL-pointer dereference.