What is the CVSS score of CVE-2026-68253?

CVE-2026-68253 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-68253?

Within 24 hours, inventory all Linux systems using Intel integrated graphics (i915 driver) and determine current kernel versions, prioritizing production and user-facing systems. Within 7 days, apply the vendor-released patch from kernel maintainers to all affected systems, testing in non-production environments first and coordinating rollout to minimize disruption. Within 30 days, complete patch deployment to 100% of inventory, verify via kernel version audits, and document the security update in your change management system.

Linux Kernel CVE-2026-68253

EUVD-2026-55354 HIGH

2026-08-10 Linux

GHSA-9cgm-8fj5-jh9j

Buffer Overflow Linux Intel

7.8

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain local user account
Delivery

Load or confirm i915/HDCP driver is active
Exploit

Craft oversized streams[] write via DRM ioctl
Execution

Trigger write before bounds check executes
Persist

Corrupt adjacent kernel memory
Impact

Escalate privileges to root

Vulnerability Assessment

Exploitation Conditions	Exploitation requires: (1) a local user account with at least low privilege on the target system (CVSS PR:L - remote exploitation is not possible per AV:L); (2) the target system must be equipped with Intel i915 GPU hardware; (3) the drm/i915/hdcp kernel module must be loaded and the HDCP code path must be reachable from userspace (typically via DRM ioctls). Limiting factors: remote exploitation is impossible; systems without Intel graphics hardware (AMD, NVIDIA, headless servers) are completely unaffected; HDCP must be active in the driver code path rather than simply compiled in. No non-default configuration setting or feature flag has been specifically identified as an additional requirement beyond Intel GPU hardware presence.
Impact	The CVSS 7.8 score with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects a local privilege escalation with real but bounded impact. The local attack vector (AV:L) is the most significant limiting factor - remote exploitation is not possible, confining the threat to authenticated users with interactive or scripted local access. EPSS at 0.18% (8th percentile) is extremely low, consistent with no known POC code and no CISA KEV listing, which together indicate this has not been observed in active exploitation campaigns. The specificity of the affected code path - Intel i915 GPU hardware with HDCP functionality active - further constrains real-world exposure beyond the CVSS score alone. Discovery through static analysis rather than incident response reinforces the absence of in-the-wild exploitation. This is a patch-cycle priority for multi-user Linux systems with Intel graphics (workstations, developer laptops, VDI environments), not an emergency-response level threat. No conflicting signals exist in the available data; all indicators point consistently to a low-probability, locally-constrained risk.
Exploit ScenarioDerived	A local attacker holding a standard user account on a Linux workstation, VDI instance, or shared compute node equipped with an Intel i915 GPU crafts an ioctl or API call into the HDCP subsystem that supplies a stream count exceeding the bounds of the `data->streams[]` array. Because the bounds check executes only after the write, the attacker overwrites adjacent kernel heap or stack memory before the kernel raises an error, potentially allowing arbitrary kernel code execution and privilege escalation to root. No public exploit code has been identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 14, 2026

Buffer overflow in the Intel i915 HDCP subsystem of the Linux kernel allows a local, low-privileged user to corrupt kernel memory with potential privilege escalation to full system compromise. The bounds check on the data->streams[] array write executes after the overrun has already occurred, meaning any caller who can trigger this code path can write past the array boundary before the kernel detects the violation. Discovered via AI-assisted static analysis and confirmed by Intel Product Security; no public exploit exists and EPSS probability is 0.18%, indicating no observed exploitation at time of analysis.

RemediationAI

Upgrade the Linux kernel to a patched stable release: 6.6.151, 6.12.103, 6.18.42, or 7.1.6 (or 7.2-rc2 for mainline tracking). Individual branch fix commits are available at the kernel stable tree: https://git.kernel.org/stable/c/84351f12390349ba010920fc247e1a0b12e41eb3 (one branch), https://git.kernel.org/stable/c/2106fb490b2c6003e23ad6ff36ce823a2170e138, https://git.kernel.org/stable/c/3d2ef8d389495e7889c6062d8bddc46d2a5fbdef, https://git.kernel.org/stable/c/984085c5b53572e2e03fd5fc4817e86ef1effc6e, and https://git.kernel.org/stable/c/bbb15a6b042d02e5508a02b4847e02d2579ee7bc. Where immediate patching is not feasible, the compensating control is to restrict or blacklist the drm/i915 module (or disable HDCP enforcement) on systems that do not require Intel GPU or HDCP functionality - note that this will disable digital video output protection for HDMI/DisplayPort connections. Headless servers and systems without Intel GPU hardware are not affected and require no action.

Affected VersionsENISA

Linux e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9 <984085c5b53572e2e03fd5fc4817e86ef1effc6e

Linux patch: 6.18.42

Linux 5.12

Linux e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9 <bbb15a6b042d02e5508a02b4847e02d2579ee7bc

Linux e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9 <84351f12390349ba010920fc247e1a0b12e41eb3

Linux e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9 <2106fb490b2c6003e23ad6ff36ce823a2170e138

Linux patch: 7.1.6

Linux patch: 6.12.103

Linux patch: 6.6.151

Linux patch: 0

Linux e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9 <3d2ef8d389495e7889c6062d8bddc46d2a5fbdef

Linux patch: 7.2-rc2

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability resides in drm/i915/hdcp, the Intel i915 Direct Rendering Manager driver's implementation of HDCP (High-bandwidth Digital Content Protection) - the copy-protection protocol governing digital video/audio streams over HDMI and DisplayPort interfaces. The root cause is a classic write-before-check ordering defect: the array bounds validation on data->streams[] was placed after the write operation rather than before it, allowing an out-of-bounds write into adjacent kernel memory before any error is surfaced. This maps conceptually to CWE-787 (Out-of-bounds Write) even though no formal CWE is assigned in the NVD record. The affected CPE is cpe:2.3:a:linux:linux:*, scoping this broadly to the Linux kernel wherever the i915 driver and its HDCP code path are loaded. The vulnerability was introduced at commit e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9 (Linux 5.12 era) and persists across all branches until the respective fix commits.

Know when Intel gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 7.8 HIGH

Local kernel driver path requires low-privileged account; out-of-bounds kernel write yields full CIA impact with no user interaction.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE 5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat 7.0 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Aug 13, 2026 - 23:37 NVD

7.8 (HIGH)

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 12:01 cve.org

HIGH 7.8

CVE Published

Aug 10, 2026 - 12:01 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/hdcp: check streams[] bounds before overflow

The data->streams[] overflow check is done after the buffer overflow has already happened. Move the overflow check before the write.

Side note, emitting a warning splat with a backtrace might be overkill here, but prefer not changing the behaviour other than not doing the overrun.

Discovered using AI-assisted static analysis confirmed by Intel Product Security.

(cherry picked from commit 9284ab3b6e776c315883ac2611283d263c9460fd)

Executive ViewAI

Why It Matters

Intel i915 HDCP subsystem buffer overflow in the Linux kernel enables local privilege escalation to root, creating risk of complete system compromise. Any local user on affected systems-particularly laptops and development workstations in enterprise environments-can exploit this to gain unauthorized administrative access. Organizations with significant Linux desktop populations face elevated risk of data theft and lateral movement across networked systems.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 92% exploitable

Prevalence

Ubiquitous

Linux kernel deployed across virtually all servers, cloud, and desktops

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

More in Intel

View all

CVE-2021-44228 CRITICAL Act Now POC

10.0 Dec 10

Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c

CVE-2017-5689 CRITICAL Act Now POC

9.8 May 02

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana

CVE-2012-5958 CRITICAL Act Now POC

10.0 Jan 31