Skip to main content

Linux Kernel CVE-2026-43477

| EUVDEUVD-2026-30013 MEDIUM
2026-05-13 Linux GHSA-f8p8-wjf5-jrx9
Information Disclosure Linux Red Hat Dell Suse
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local user session on ICL Intel system
  2. Delivery
    Connect external display via USB-C dock with defective cable
  3. Exploit
    Link training fails during display initialization
  4. Execution
    Kernel writes TRANS_VRR_VMAX/FLIPLINE before TRANS_DDI_FUNC_CTL is enabled
  5. Persist
    Machine Check Error fires on ICL hardware
  6. Impact
    System hang - complete local denial of service

Vulnerability Assessment

Exploitation Conditions

Exploitation requires a local low-privilege user session on an ICL (Intel Ice Lake) generation system with the i915 kernel DRM driver active and VRR configured. The hang is triggered specifically when an external display is connected via a USB-C dock using a cable that induces link training failure during display initialization. TGL (Tiger Lake) and presumably later Intel GPU generations are not vulnerable regardless of configuration. Systems with no external display connected, or with stable links that complete link training successfully, are unlikely to trigger the hang in normal operation. Limiting factors are the conjunction of: ICL-specific GPU silicon, VRR being enabled, external display via dock, and link training failure - all four conditions must align simultaneously.
Impact

The NVD-assigned CVSS 3.1 score of 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H captures a local, low-privilege, availability-only impact. EPSS of 0.02% at the 4th percentile aligns with expectations for a hardware-specific kernel driver sequencing bug with no publicly available exploit code. The vulnerability is absent from CISA KEV, and no POC has been reported. The 'Information Disclosure' tag in the provided intelligence metadata appears to be a misclassification - both the CVSS impact metrics (C:N/I:N/A:H) and the technical description confirm purely an availability impact (system hang), with zero confidentiality or integrity compromise; this discrepancy should be noted when using this CVE in asset tracking. Real-world risk is substantially bounded by the hardware prerequisite: only ICL-generation Intel GPU systems are affected, and the hang is most reliably reproduced when link training fails on an external display connected via a USB-C dock - a specific and non-universal scenario. SSVC signals suggest low automatability and low technical exploitation priority for the general enterprise environment. This is a genuine bug warranting patch deployment, particularly in fleet environments with ICL hardware and external display usage, but it does not constitute an emergency priority.
Exploit ScenarioDerived

A local low-privilege user on an ICL-generation Intel system such as a Dell XPS 7390 2-in-1 connects an external display through a USB-C dock using a defective cable that causes link training to fail. During display initialization the kernel i915 driver writes VRR timing registers out of sequence, triggering a Machine Check Error that causes an unrecoverable system hang - denying service to all users of the machine. No public exploit code exists for this vulnerability at time of analysis.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 26, 2026

System hang via Machine Check Error (MCE) in the Linux kernel's Intel i915 DRM driver affects ICL (Ice Lake) generation GPU hardware when VRR timing registers are written before TRANS_DDI_FUNC_CTL is enabled, violating Intel BSpec 22243. Local low-privilege users on ICL systems - particularly those with external displays connected through USB-C docks experiencing link training failure - can trigger an unrecoverable system hang. No public exploit exists and EPSS is 0.02%, consistent with the hardware-specific, condition-dependent nature of the bug; no active exploitation is confirmed.

RemediationAI

The primary fix is upgrading the Linux kernel to a patched release: version 7.0, 6.19.9, or 6.18.20, or a 6.16 stable build incorporating commits 8a7d29b8bda144d44e61df1b2705b1d4378f4e44, bf9e3b6ffd76da38dd4961c65d80571b25bf10a5, or 237aab549676288d9255bb8dcc284738e56eaa31 as applicable to the running branch (see https://git.kernel.org/stable/c/8a7d29b8bda144d44e61df1b2705b1d4378f4e44 and sibling commits). As a compensating control on ICL systems where immediate patching is not feasible, disabling VRR (Variable Refresh Rate / adaptive sync) in the display compositor or monitor settings eliminates the vulnerable register-programming code path entirely - the trade-off is loss of adaptive sync and reduced display smoothness. Avoiding external displays connected through USB-C docks with low-quality or damaged cables reduces the probability of the link training failure that most reliably triggers the hang, though this is risk reduction rather than a complete mitigation. Downstream Linux distribution advisories (Debian, Red Hat, Ubuntu, SUSE) should be consulted for distro-specific package versions; no vendor advisory URL beyond NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-43477) and VulDB (https://vuldb.com/vuln/363534) is currently available.

Affected VersionsENISA

Linux patch: 7.0
Linux patch: 6.19.9
Linux patch: 0
Linux dda7dcd9da73c5327aef42b89f0519bb51e84217 <bf9e3b6ffd76da38dd4961c65d80571b25bf10a5
Linux dda7dcd9da73c5327aef42b89f0519bb51e84217 <237aab549676288d9255bb8dcc284738e56eaa31
Linux dda7dcd9da73c5327aef42b89f0519bb51e84217 <8a7d29b8bda144d44e61df1b2705b1d4378f4e44
Linux 6.16
Linux patch: 6.18.20

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in the Variable Refresh Rate (VRR) subsystem of the Intel i915 DRM (Direct Rendering Manager) driver within the Linux kernel (CPE: cpe:2.3:a:linux:linux:*). ICL (Ice Lake) generation GPUs require TRANS_VRR_VMAX, TRANS_VRR_FLIPLINE, and related VRR timing registers to be programmed only after TRANS_DDI_FUNC_CTL (DDI Function Control) is enabled. The driver violated this sequencing requirement - mandated by Intel BSpec 22243 - by writing VRR timing registers before enabling TRANS_DDI_FUNC_CTL. This out-of-order register programming triggers a Machine Check Error (MCE) on ICL, causing an unrecoverable system hang. The DMC firmware itself handles VRR restoration in two distinct phases: phase one is unconditional and covers TRANS_VRR_CTL plus ancillary registers; phase two is conditional on the DDI being enabled and covers TRANS_DDI_FUNC_CTL, TRANS_VRR_VMAX, TRANS_VRR_VMIN, and TRANS_VRR_FLIPLINE. The kernel driver's failure to mirror this two-stage ordering is the root cause. No CWE is formally assigned; the root cause class is incorrect hardware register initialization order. TGL (Tiger Lake) appears immune to the same register ordering issue, likely due to architectural differences in MCE handling.

Know when Dell gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 4.7 MEDIUM

ICL-specific hardware, VRR-enabled external display, and link training failure must all coincide, making AC:H more accurate than the NVD-assigned AC:L.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 5.5 LOW

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 26, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch available
May 13, 2026 - 16:33 EUVD
CVE Published
May 13, 2026 - 15:08 nvd
MEDIUM 5.5
CVE Published
May 13, 2026 - 15:08 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/vrr: Configure VRR timings after enabling TRANS_DDI_FUNC_CTL

Apparently ICL may hang with an MCE if we write TRANS_VRR_VMAX/FLIPLINE before enabling TRANS_DDI_FUNC_CTL.

Personally I was only able to reproduce a hang (on an Dell XPS 7390 2-in-1) with an external display connected via a dock using a dodgy type-C cable that made the link training fail. After the failed link training the machine would hang. TGL seemed immune to the problem for whatever reason.

BSpec does tell us to configure VRR after enabling TRANS_DDI_FUNC_CTL as well. The DMC firmware also does the VRR restore in two stages:

  • first stage seems to be unconditional and includes TRANS_VRR_CTL

and a few other VRR registers, among other things

  • second stage is conditional on the DDI being enabled,

and includes TRANS_DDI_FUNC_CTL and TRANS_VRR_VMAX/VMIN/FLIPLINE, among other things

So let's reorder the steps to match to avoid the hang, and toss in an extra WARN to make sure we don't screw this up later.

BSpec: 22243 (cherry picked from commit 93f3a267c3dd4d811b224bb9e179a10d81456a74)

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Prevalence
Ubiquitous
Linux kernel deployed across the vast majority of servers, embedded systems, and devices globally
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
High

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Dell

View all
CVE-2012-2962 MEDIUM POC
6.5 Jul 30

SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2

CVE-2014-8420 CRITICAL POC
9.0 Nov 25

The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
CVE-2012-3951 HIGH POC
7.5 Jul 31

The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
CVE-2014-4977 MEDIUM POC
6.5 Jul 16

Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute

CVE-2026-22769 CRITICAL
10.0 Feb 17

Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) t
CVE-2014-125113 CRITICAL POC
9.3 Aug 05

An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers
CVE-2012-2626 MEDIUM POC
5.0 Jul 31

cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requir
CVE-2014-8272 MEDIUM POC
5.0 Dec 19

The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57

CVE-2016-9683 CRITICAL POC
9.8 Feb 22

The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerabili
CVE-2016-9682 CRITICAL POC
9.8 Feb 22

The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to two Remote Command Injection vulnerabi
CVE-2016-9684 CRITICAL POC
9.8 Feb 22

The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerabili
CVE-2017-10955 HIGH
8.8 Oct 19

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-43477 ADVISORY https://vuldb.com/vuln/363534 REF https://git.kernel.org/stable/c/237aab549676288d9255bb8dcc284738e56eaa31 REF https://git.kernel.org/stable/c/8a7d29b8bda144d44e61df1b2705b1d4378f4e44 REF https://git.kernel.org/stable/c/bf9e3b6ffd76da38dd4961c65d80571b25bf10a5

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy