Skip to main content

Linux Kernel EUVDEUVD-2026-30013

| CVE-2026-43477 MEDIUM
2026-05-13 Linux GHSA-f8p8-wjf5-jrx9
Linux Dell Information Disclosure Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

ICL-specific hardware, VRR-enabled external display, and link training failure must all coincide, making AC:H more accurate than the NVD-assigned AC:L.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 26, 2026 - 22:31 vuln.today
CVSS changed
Jun 26, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch available
May 13, 2026 - 16:33 EUVD
CVE Published
May 13, 2026 - 15:08 nvd
MEDIUM 5.5
CVE Published
May 13, 2026 - 15:08 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/vrr: Configure VRR timings after enabling TRANS_DDI_FUNC_CTL

Apparently ICL may hang with an MCE if we write TRANS_VRR_VMAX/FLIPLINE before enabling TRANS_DDI_FUNC_CTL.

Personally I was only able to reproduce a hang (on an Dell XPS 7390 2-in-1) with an external display connected via a dock using a dodgy type-C cable that made the link training fail. After the failed link training the machine would hang. TGL seemed immune to the problem for whatever reason.

BSpec does tell us to configure VRR after enabling TRANS_DDI_FUNC_CTL as well. The DMC firmware also does the VRR restore in two stages:

  • first stage seems to be unconditional and includes TRANS_VRR_CTL

and a few other VRR registers, among other things

  • second stage is conditional on the DDI being enabled,

and includes TRANS_DDI_FUNC_CTL and TRANS_VRR_VMAX/VMIN/FLIPLINE, among other things

So let's reorder the steps to match to avoid the hang, and toss in an extra WARN to make sure we don't screw this up later.

BSpec: 22243 (cherry picked from commit 93f3a267c3dd4d811b224bb9e179a10d81456a74)

AnalysisAI

System hang via Machine Check Error (MCE) in the Linux kernel's Intel i915 DRM driver affects ICL (Ice Lake) generation GPU hardware when VRR timing registers are written before TRANS_DDI_FUNC_CTL is enabled, violating Intel BSpec 22243. Local low-privilege users on ICL systems - particularly those with external displays connected through USB-C docks experiencing link training failure - can trigger an unrecoverable system hang. No public exploit exists and EPSS is 0.02%, consistent with the hardware-specific, condition-dependent nature of the bug; no active exploitation is confirmed.

Technical ContextAI

The vulnerability resides in the Variable Refresh Rate (VRR) subsystem of the Intel i915 DRM (Direct Rendering Manager) driver within the Linux kernel (CPE: cpe:2.3:a:linux:linux:*). ICL (Ice Lake) generation GPUs require TRANS_VRR_VMAX, TRANS_VRR_FLIPLINE, and related VRR timing registers to be programmed only after TRANS_DDI_FUNC_CTL (DDI Function Control) is enabled. The driver violated this sequencing requirement - mandated by Intel BSpec 22243 - by writing VRR timing registers before enabling TRANS_DDI_FUNC_CTL. This out-of-order register programming triggers a Machine Check Error (MCE) on ICL, causing an unrecoverable system hang. The DMC firmware itself handles VRR restoration in two distinct phases: phase one is unconditional and covers TRANS_VRR_CTL plus ancillary registers; phase two is conditional on the DDI being enabled and covers TRANS_DDI_FUNC_CTL, TRANS_VRR_VMAX, TRANS_VRR_VMIN, and TRANS_VRR_FLIPLINE. The kernel driver's failure to mirror this two-stage ordering is the root cause. No CWE is formally assigned; the root cause class is incorrect hardware register initialization order. TGL (Tiger Lake) appears immune to the same register ordering issue, likely due to architectural differences in MCE handling.

RemediationAI

The primary fix is upgrading the Linux kernel to a patched release: version 7.0, 6.19.9, or 6.18.20, or a 6.16 stable build incorporating commits 8a7d29b8bda144d44e61df1b2705b1d4378f4e44, bf9e3b6ffd76da38dd4961c65d80571b25bf10a5, or 237aab549676288d9255bb8dcc284738e56eaa31 as applicable to the running branch (see https://git.kernel.org/stable/c/8a7d29b8bda144d44e61df1b2705b1d4378f4e44 and sibling commits). As a compensating control on ICL systems where immediate patching is not feasible, disabling VRR (Variable Refresh Rate / adaptive sync) in the display compositor or monitor settings eliminates the vulnerable register-programming code path entirely - the trade-off is loss of adaptive sync and reduced display smoothness. Avoiding external displays connected through USB-C docks with low-quality or damaged cables reduces the probability of the link training failure that most reliably triggers the hang, though this is risk reduction rather than a complete mitigation. Downstream Linux distribution advisories (Debian, Red Hat, Ubuntu, SUSE) should be consulted for distro-specific package versions; no vendor advisory URL beyond NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-43477) and VulDB (https://vuldb.com/vuln/363534) is currently available.

More in Dell

View all
CVE-2012-2962 MEDIUM POC
6.5 Jul 30

SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2

CVE-2014-8420 CRITICAL POC
9.0 Nov 25

The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
CVE-2012-3951 HIGH POC
7.5 Jul 31

The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
CVE-2014-4977 MEDIUM POC
6.5 Jul 16

Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute

CVE-2026-22769 CRITICAL
10.0 Feb 17

Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) t
CVE-2014-125113 CRITICAL POC
9.3 Aug 05

An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers
CVE-2012-2626 MEDIUM POC
5.0 Jul 31

cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requir
CVE-2014-8272 MEDIUM POC
5.0 Dec 19

The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57

CVE-2017-10955 HIGH
8.8 Oct 19

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection

CVE-2012-2627 CRITICAL POC
9.4 Jul 31

d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote at
CVE-2021-21551 HIGH POC
7.8 May 04

Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile
CVE-2025-36604 HIGH POC
7.3 Aug 04

Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-30013 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy