What is the CVSS score of CVE-2026-68253?

CVE-2026-68253 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-68253?

Intel i915 HDCP subsystem buffer overflow in the Linux kernel enables local privilege escalation to root, creating risk of complete system compromise.. A patch is available.

How to fix or mitigate CVE-2026-68253?

Within 24 hours, inventory all Linux systems using Intel integrated graphics (i915 driver) and determine current kernel versions, prioritizing production and user-facing systems. Within 7 days, apply the vendor-released patch from kernel maintainers to all affected systems, testing in non-production environments first and coordinating rollout to minimize disruption. Within 30 days, complete patch deployment to 100% of inventory, verify via kernel version audits, and document the security update in your change management system.

Linux Kernel CVE-2026-68253

EUVD-2026-55354 HIGH

2026-08-10 Linux

GHSA-9cgm-8fj5-jh9j

Intel Buffer Overflow Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local kernel driver path requires low-privileged account; out-of-bounds kernel write yields full CIA impact with no user interaction.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 03:27 vuln.today

CVSS changed

Aug 13, 2026 - 23:37 NVD

7.8 (HIGH)

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 12:01 cve.org

HIGH 7.8

CVE Published

Aug 10, 2026 - 12:01 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/hdcp: check streams[] bounds before overflow

The data->streams[] overflow check is done after the buffer overflow has already happened. Move the overflow check before the write.

Side note, emitting a warning splat with a backtrace might be overkill here, but prefer not changing the behaviour other than not doing the overrun.

Discovered using AI-assisted static analysis confirmed by Intel Product Security.

(cherry picked from commit 9284ab3b6e776c315883ac2611283d263c9460fd)

AnalysisAI

Buffer overflow in the Intel i915 HDCP subsystem of the Linux kernel allows a local, low-privileged user to corrupt kernel memory with potential privilege escalation to full system compromise. The bounds check on the data->streams[] array write executes after the overrun has already occurred, meaning any caller who can trigger this code path can write past the array boundary before the kernel detects the violation. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires: (1) a local user account with at least low privilege on the target system (CVSS PR:L - remote exploitation is not possible per AV:L); (2) the target system must be equipped with Intel i915 GPU hardware; (3) the drm/i915/hdcp kernel module must be loaded and the HDCP code path must be reachable from userspace (typically via DRM ioctls). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 7.8 score with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects a local privilege escalation with real but bounded impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade the Linux kernel to a patched stable release: 6.6.151, 6.12.103, 6.18.42, or 7.1.6 (or 7.2-rc2 for mainline tracking). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Linux systems using Intel integrated graphics (i915 driver) and determine current kernel versions, prioritizing production and user-facing systems. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Intel

View all

CVE-2017-5689 CRITICAL Act Now POC

9.8 May 02

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana

CVE-2012-5958 CRITICAL Act Now POC

10.0 Jan 31