DEBIAN-CVE-2026-99146: Debian/linux vulnerability

Published Oct 28, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Add sanity check for DMC load address For DMC firmware header version 3, the firmware load address is stored in dmcinfo->startmmioaddr and later used by dmcloadprogram(). Unlike the MMIO address table, the firmware load address is not validated. Add a sanity check to ensure it is within the valid range. BSpec: 69671, 68378 (cherry picked from commit 5e47ee5c76ca9becde8df4ad5202845b7ffcbc4c)

Affected Software

3 affected components

debian/linux*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 5e47ee5c76ca9becde8df4ad5202845b7ffcbc4c

Event History

Oct 28, 2026

CVE Published

via OSV·11:17 AM

Data Sourced

via OSV·11:17 AM

DescriptionAffected Software

Frequently Asked Questions

What condition is associated with the vulnerable code path?

The issue concerns DMC firmware header version 3, where the firmware load address is stored in dmc_info->start_mmioaddr and later used by dmc_load_program(). The problematic condition is a load address outside the valid range.

What does the resolution change?

The resolved change adds a sanity check for the DMC firmware load address before it is used. This validates that the address falls within the valid range.

DEBIAN-CVE-2026-99146: Debian/linux vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What condition is associated with the vulnerable code path?

What does the resolution change?

Company

Resources

Contact

Frequently Asked Questions

What condition is associated with the vulnerable code path?

What does the resolution change?