What is the CVSS score of CVE-2026-43368?

CVE-2026-43368 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Linux Kernel are affected by CVE-2026-43368?

CVE-2026-43368 is a high-severity integer overflow in the Linux kernel's Intel i915 graphics driver that can corrupt memory mappings for large GPU buffer objects (>4GB), potentially causing system…. A patch is available.

How to fix or mitigate CVE-2026-43368?

Within 24 hours: Identify all systems running Linux kernel versions prior to 6.6.130, 6.12.78, 6.18.19, 6.19.9, or 7.0 with i915 graphics drivers enabled. Within 7 days: Test and deploy kernel updates to patched versions (6.6.130, 6.12.78, 6.18.19, 6.19.9, or 7.0) in non-production environments. Within 30 days: Complete production kernel patching with coordinated reboots, prioritizing systems handling large GPU workloads or running graphics-intensive applications.

Linux Kernel CVE-2026-43368

EUVD-2026-28674 HIGH

2026-05-08 Linux

GHSA-rm7m-cqfw-43rf

Intel Buffer Overflow Linux

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 11, 2026 - 08:29 vuln.today

CVSS changed

May 11, 2026 - 08:22 NVD

7.8 (HIGH)

Patch available

May 08, 2026 - 16:18 EUVD

CVE Published

May 08, 2026 - 14:21 nvd

HIGH 7.8

CVE Published

May 08, 2026 - 14:21 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/i915: Fix potential overflow of shmem scatterlist length

When a scatterlists table of a GEM shmem object of size 4 GB or more is populated with pages allocated from a folio, unsigned int .length attribute of a scatterlist may get overflowed if total byte length of pages allocated to that single scatterlist happens to reach or cross the 4GB limit. As a consequence, users of the object may suffer from hitting unexpected, premature end of the object's backing pages.

[278.780187] ------------[ cut here ]------------ [278.780377] WARNING: CPU: 1 PID: 2326 at drivers/gpu/drm/i915/i915_mm.c:55 remap_sg+0x199/0x1d0 [i915] ... [278.780654] CPU: 1 UID: 0 PID: 2326 Comm: gem_mmap_offset Tainted: G S U 6.17.0-rc1-CI_DRM_16981-ged823aaa0607+ #1 PREEMPT(voluntary) [278.780656] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER [278.780658] Hardware name: Intel Corporation Meteor Lake Client Platform/MTL-P LP5x T3 RVP, BIOS MTLPFWI1.R00.3471.D91.2401310918 01/31/2024 [278.780659] RIP: 0010:remap_sg+0x199/0x1d0 [i915] ... [278.780786] Call Trace: [278.780787] <TASK> [278.780788] ? __apply_to_page_range+0x3e6/0x910 [278.780795] ? __pfx_remap_sg+0x10/0x10 [i915] [278.780906] apply_to_page_range+0x14/0x30 [278.780908] remap_io_sg+0x14d/0x260 [i915] [278.781013] vm_fault_cpu+0xd2/0x330 [i915] [278.781137] __do_fault+0x3a/0x1b0 [278.781140] do_fault+0x322/0x640 [278.781143] __handle_mm_fault+0x938/0xfd0 [278.781150] handle_mm_fault+0x12c/0x300 [278.781152] ? lock_mm_and_find_vma+0x4b/0x760 [278.781155] do_user_addr_fault+0x2d6/0x8e0 [278.781160] exc_page_fault+0x96/0x2c0 [278.781165] asm_exc_page_fault+0x27/0x30 ...

That issue was apprehended by the author of a change that introduced it, and potential risk even annotated with a comment, but then never addressed.

When adding folio pages to a scatterlist table, take care of byte length of any single scatterlist not exceeding max_segment.

(cherry picked from commit 06249b4e691a75694c014a61708c007fb5755f60)

AnalysisAI

Integer overflow in Linux kernel's i915 graphics driver corrupts memory mapping for DRM/GEM shmem objects larger than 4GB, causing kernel warnings, potential crashes, and incorrect memory access when Intel graphics hardware processes large buffer objects. The vulnerability manifests when scatterlist length fields overflow during folio page allocation, leading to premature termination of backing page iteration. Patch available across multiple stable kernel branches (6.6.130, 6.12.78, 6.18.19, 6.19.9, 7.0) per upstream commits. EPSS score of 0.02% (5th percentile) indicates low observed exploitation probability, and no public exploit code or CISA KEV listing exists at time of analysis.

Technical ContextAI

The vulnerability resides in the Direct Rendering Manager (DRM) subsystem's i915 Intel graphics driver, specifically in scatterlist management for Graphics Execution Manager (GEM) shmem objects. When allocating backing storage for GPU-accessible memory objects exceeding 4GB, the driver populates scatterlist structures with pages from folios (compound pages). The scatterlist structure uses an unsigned 32-bit integer for its .length attribute, which can overflow when aggregating page byte lengths that reach or exceed 2^32 bytes (4GB) within a single scatterlist entry. This is a classic CWE-190 (Integer Overflow) scenario where mathematical operations on fixed-width integers exceed representable values. The overflow causes the length field to wrap to small values, making memory mapping operations believe the buffer ends prematurely. The code path triggers during CPU page fault handling (vm_fault_cpu) when userspace processes attempt to access mapped GPU memory regions, as evidenced by the stack trace showing remap_sg→apply_to_page_range→__handle_mm_fault call chain.

RemediationAI

Update to patched Linux kernel versions: 6.6.130, 6.12.78, 6.18.19, 6.19.9, or 7.0 and later, as documented in upstream stable commits available at https://git.kernel.org/stable/c/aeb7255531ba4a5c3a64938577170d08b78de399 (and related commit hashes eae4bf410757, 1c956f0fccc2, 21a301f12d18, 029ae067431a). Distributions should apply vendor-provided kernel updates incorporating these fixes. For systems unable to immediately patch, implement compensating controls by limiting individual GPU memory allocations below 4GB through application-level constraints or ulimit restrictions, though this significantly impacts legitimate high-memory GPU workloads and may break scientific computing applications. Alternatively, disable i915 kernel module and use software rendering if graphics acceleration is non-essential, accepting severe performance degradation trade-offs. Monitor kernel logs for i915 WARNING signatures at drivers/gpu/drm/i915/i915_mm.c:55 indicating active triggering of the condition. No userspace workaround fully mitigates the kernel-level integer overflow without patching.

More in Intel

View all

CVE-2017-5689 CRITICAL Act Now POC

9.8 May 02

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana

CVE-2012-5958 CRITICAL Act Now POC

10.0 Jan 31