EUVD-2026-108800
GHSA-rj8m-rj3g-fqjh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access to i915 DRI/render node
-
DeliveryCraft GEM execbuffer ioctl requiring relocations
-
ExploitTrigger eb_relocate_parse_slow with command parser appending VMAs
-
ExecutionCleanup kvfree() oversteps original exec array
-
ImpactCorrupt kernel memory for privilege escalation
Vulnerability Assessment
| Exploitation Conditions | Requires local code execution on the host with sufficient privilege to open the Intel i915 DRI device and issue GEM execbuffer ioctls (consistent with PR:L), and the system must have the i915 driver loaded (Intel GPU present). The attacker must drive the legacy relocation slow path: eb_copy_relocations() allocating per-buffer_count copies while eb_parse() appends VMAs and increments eb->buffer_count, so that the 'out' cleanup kvfree()s beyond the original exec object count. Limiting factors: exploitation is local only (no network reachability), needs the i915/Intel-GPU codepath and the relocation feature exercised (modern no-reloc userspace may not hit it by default), and requires an unpatched kernel branch before the listed fixed versions. No user interaction by a separate victim is required (UI:N). |
| Impact | This is a local privilege-escalation-class memory safety bug in the Intel i915 DRM/GEM execbuffer path, not a remotely reachable flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H, base 7.8 HIGH) is internally consistent with the description: exploitation requires local access and some privilege (access to the DRI device), with low complexity and full impact via kernel memory corruption. Multi-source signals point toward moderate rather than urgent real-world risk: EPSS is low (0.21%, 11th percentile), the CVE is NOT in CISA KEV, and the references are stable-tree patch commits rather than any exploit or PoC, so exploitation status is 'no public exploit identified at time of analysis'. The vuln.today decision label is 'this_week', which is a routine (non-emergency) priority consistent with the low EPSS and absence of KEV listing. No SSVC exploitation/automatable/technical-impact decision points were supplied, so that framework cannot be cross-referenced here. CWE is N/A in the input; from the description the defect is an out-of-bounds kvfree() (freeing exec-array slots beyond the original object count), i.e. a memory-corruption/invalid-free issue. Net: a legitimate HIGH-severity local kernel bug that warrants scheduled patching, but the local-only vector, low EPSS, and lack of KEV/PoC mean it is not a drop-everything emergency. |
| Exploit ScenarioDerived | A local user with access to the Intel GPU render/DRI device submits a crafted i915 GEM execbuffer ioctl that forces the slow relocation path (eb_relocate_parse_slow). The command parser appends up to two VMAs and increments eb->buffer_count, after which the 'out' cleanup calls kvfree() using the inflated count, freeing pointers past the original exec array and corrupting kernel memory. No public exploit code is identified; the only published artifacts are the upstream fix commits. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 24, 2026
Local privilege escalation and memory corruption in the Intel i915 DRM/GEM execbuffer path of the Linux kernel, where cleanup of failed execbuffer parsing frees pointers past the end of the relocated exec object array. Kernels built with the i915 driver (Intel GPU systems) on branches prior to the fixed releases 6.6.160, 6.12.113, 6.18.57, 7.2.11 and 7.3 are affected, and an attacker needs local access to the i915 DRI device plus a workload that drives the legacy relocation slow path; the assessed impact is high for confidentiality, integrity and availability on the host. No public exploit has been identified at time of analysis and EPSS is low at 0.21% (11th percentile), but the vendor fix is available and patching is scheduled for this week.
RemediationAI
Vendor-released patches are available: update to Linux 6.6.160, 6.12.113, 6.18.57, 7.2.11 or 7.3, or import the corresponding stable commits 72d5cbb10d4916a3f8ef9da516c5c0634aca8439, b1c357131fc467c579f65e9a9d1fdc1a6273ae1d, 152fb5083b9333a1cb8629572f9e0f276a404ba6, 24c04e80c35ff36947366f6deafddb522eea080c or ebe162db655881a38de43301151ff7ac940602b5 from https://git.kernel.org/stable/. Where the kernel cannot be updated immediately, reducing exposure is possible because exploitation requires local access to the i915 DRI device: restrict /dev/dri/card* and /dev/dri/renderD* permissions to trusted local users or confined containers, at the cost of removing GPU acceleration for unprivileged sessions, or run guest/unprivileged workloads without passing through the i915 device, noting that these only narrow the attack surface and do not repair the faulty cleanup path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability sits in the i915 graphics driver's GEM ioctl layer, specifically the execbuffer relocation handling in eb_relocate_parse_slow(). When the fast path fails, eb_copy_relocations() allocates relocation storage sized to the current eb->buffer_count of exec objects, and eb_parse() subsequently appends up to two VMAs to the exec list while incrementing eb->buffer_count. The error/cleanup path under the 'out' label then iterates using that incremented count and calls kvfree() on relocation pointers indexed beyond the original exec array, so pointers taken from the VMA region are treated as relocation bookkeeping and freed. The result is an out-of-bounds access against the exec object array with kernel-heap consequences; the fix threads the original exec object count through cleanup so relocation release excludes VMAs appended by the command parser (upstream cherry-pick 2a0158925fb943c7ba8f3216e2734952128defc9). No CWE was supplied with the record, but the mechanism described in the sources is an off-by-count boundary error rather than a race or timing condition. Exposed systems are those with the i915 driver bound to an Intel GPU and userspace that still exercises the relocation path, which modern no-reloc userspace may avoid by default.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local DRI-device access with low privilege (PR:L, AV:L), attacker-controlled buffer_count/relocations makes triggering straightforward (AC:L), and kernel memory corruption yields full C/I/A impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/gem: Prevent overstepping exec array boundary
It is possible for eb_relocate_parse_slow() to call kvfree() on entries outside the original exec array during following scenario inside eb_relocate_parse_slow():
- eb_copy_relocations() allocates as many as eb->buffer_count
copies for exec entries;
- eb_parse() appends up to two VMAs, right after incrementing
eb->buffer_count;
- cleanup under "out" label uses this incremented buffer_count
to release relocation pointers from exec array via kvfree(), not from VMA array.
To amend this problem, ensure that relocation cleanup uses the original exec object count, excluding the VMAs appended by the command parser.
(cherry picked from commit 2a0158925fb943c7ba8f3216e2734952128defc9)
Executive ViewAI
A high-severity flaw in the Linux kernel's Intel GPU driver allows local attackers to cause memory corruption and escalate privileges, potentially compromising the confidentiality, integrity, and availability of affected systems. Leadership should care because this affects any Linux systems with Intel GPUs where users have local access, and a vendor fix is available but not yet broadly deployed.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB