Linux Kernel EUVD-2026-26580

The vulnerability requires all of the following conditions to trigger: (1) Linux kernel version 5.6 or later with the vulnerable i915 code path; (2) Intel integrated graphics (i915 driver actively used); (3) Display using DSI (Display Serial Interface) protocol; (4) DSC (Display Stream Compression) enabled on the panel; (5) Panel operating in command mode (not video mode, which is unaffected per Bspec). The driver must load or reinitialize-this happens automatically at boot, module load, or display hotplug. A local authenticated user must have the ability to trigger driver initialization (typically happens automatically). Systems without DSI+DSC panels in command mode are not vulnerable; common external monitors and embedded displays are typically in video mode and unaffected. Machines like Huawei Matebook E with specific integrated DSI+DSC panels in command mode are primary targets.

CVSS 5.5 with local attack vector and low complexity indicates moderate severity requiring local user interaction. However, EPSS score of 0.02% (5th percentile) signals very low real-world exploitation probability, suggesting this is a driver loading issue triggered during kernel initialization on specific hardware rather than a remotely exploitable vulnerability. The attack vector (AV:L) and privilege requirement (PR:L) mean only local authenticated users can trigger the panic by loading the i915 driver on affected hardware. The availability impact (A:H) is denial of service-kernel panic-rather than code execution or data breach. SSVC framework: exploitation status is unproven (not publicly exploited despite patch availability), technical impact is denial of service (system reboot), automatable only on affected hardware with DSC panels in command mode. The true risk is lower than raw CVSS suggests: this is a kernel stability issue on niche hardware (premium laptops with specific DSI panel configurations) rather than widespread vulnerability. Organizations running Linux on affected Huawei/Intel hardware should prioritize patching; general Linux deployments face negligible risk.

A local user with standard privileges on a Linux system running an affected kernel version and containing Intel integrated graphics with a DSC-enabled DSI panel in command mode (e.g., Huawei Matebook E) boots the machine or reloads the i915 driver module. The driver initializes, encounters the DSC panel in command mode, calculates incorrect horizontal timing adjustments, produces a zero line_time_us value, and attempts division by zero in vtotal calculation, causing immediate kernel panic and system reboot. No user interaction or network access required; local physical access or remote session on affected hardware triggers the issue during normal driver initialization.