CVE-2026-99118 in Linux
Summary
by MITRE • 10/28/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/dmc: Harden DMC firmware payload parsing
Validate the conversion of the DMC firmware size from dwords to bytes using check_mul_overflow() before calculating the firmware payload size.
Reject zero-length payloads and zero MMIO counts in the DMC firmware header so malformed firmware is caught early. Also set dmc_fw_size only after the payload allocation succeeds.
(cherry picked from commit efde6601a1f1daedfe3dcc2816c934ddb44e3eef)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The Linux kernel's Intel graphics driver, specifically within the Display Microcontroller (DMC) firmware handling subsystem, has been updated to address critical security flaws related to integer overflow and improper resource management. The DMC is a specialized microcontroller embedded in Intel GPUs that manages power states and display configurations by executing firmware loaded from system memory. This vulnerability stems from insufficient validation of input data provided during the parsing of DMC firmware images. Specifically, the conversion logic for calculating the size of the firmware payload involved multiplying values without adequate overflow protection. In C-based kernel development, integer overflows can lead to significantly smaller allocated buffer sizes than intended by the attacker or malformed source file. By failing to detect when a multiplication operation exceeds the maximum value representable by an unsigned 32-bit integer, the system could allocate a buffer that is far too small for the actual data being processed. This creates a classic heap-based buffer overflow scenario where subsequent writes to this undersized buffer can corrupt adjacent memory structures, potentially leading to arbitrary code execution or kernel panic depending on the layout of memory and the specific payload injected by an attacker with access to display configuration interfaces.
To mitigate these risks, developers have implemented rigorous validation checks using the check_mul_overflow() function before performing any arithmetic operations that determine memory allocation sizes. This ensures that if a multiplication would result in an integer overflow, the operation is aborted immediately rather than proceeding with a truncated size value. Furthermore, the patch introduces strict rejection criteria for malformed firmware headers. Specifically, zero-length payloads and zero Memory-Mapped Input/Output (MMIO) counts are now explicitly rejected during the initial parsing phase. This early validation prevents the kernel from attempting to process or allocate resources for invalid firmware structures that could otherwise trigger undefined behavior or exploitation vectors later in the execution flow. By catching these anomalies at the entry point of the parser, the system avoids entering unstable states caused by processing corrupted data streams.
The operational impact of this vulnerability is significant because it affects a component with high privileges within the kernel space. An attacker who can influence the content of DMC firmware files or intercept and modify display configuration requests could exploit these flaws to escalate privileges from an unprivileged user context to root level. This aligns with Common Weakness Enumeration (CWE) identifiers such as CWE-190 Integer Overflow or Wraparound, which describes errors resulting from arithmetic operations that exceed the capacity of a data type, and CWE-787 Out-of-bounds Write, which covers writing beyond the allocated buffer boundaries. Additionally, this vulnerability relates to ATT&CK technique T1203 Exploitation for Defense Evasion, as malformed firmware parsing is often used in advanced persistent threats to bypass security controls by triggering unexpected code paths or crashing defensive mechanisms.
The remediation strategy also includes a critical improvement in resource management sequencing. The patch ensures that the global variable dmc_fw_size is only updated after the successful allocation of the payload buffer. This change prevents race conditions and logic errors where the size indicator might be set to an invalid value before the corresponding memory is actually available, which could lead to use-after-free vulnerabilities or access violations if other parts of the driver attempt to reference the firmware data based on premature size indicators. By enforcing a strict order of operations—validate input, allocate resources safely, then update state variables—the kernel maintains consistency and integrity in its internal representations of loaded firmware objects. This hardening measure is part of an ongoing effort to secure the graphics subsystem against sophisticated attacks that target low-level hardware interaction points.
Administrators should ensure their systems are updated with the latest stable Linux kernel versions containing this cherry-picked commit efde6601a1f1daedfe3dcc2816c934ddb44e3eef. Since DMC firmware is typically loaded during system boot or display initialization, local users with access to graphical interfaces may have the ability to trigger these code paths. Therefore, keeping the kernel patched is essential for maintaining the integrity of the graphics subsystem and preventing potential privilege escalation attacks. The fix exemplifies best practices in secure coding by combining input validation, overflow detection, and safe resource allocation patterns to eliminate entire classes of memory corruption vulnerabilities inherent in complex driver implementations.