What is the CVSS score of EUVD-2026-45769?

EUVD-2026-45769 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate EUVD-2026-45769?

Within 24 hours, inventory systems running Intel Arc discrete GPUs (DG2) on Linux and confirm patch availability from your kernel vendor (Red Hat, Canonical, SUSE, etc.). Within 7 days, deploy the available kernel patch to affected production systems, prioritizing those accessible to untrusted users or running sensitive workloads. By 30 days, complete patch deployment across all affected infrastructure, validate GPU functionality, and document remediation completion.

Linux Kernel EUVD-2026-45769

| CVE-2026-63884 HIGH

Use After Free (CWE-416)

2026-07-19 Linux

GHSA-8mf8-7jc8-gw2x

Information Disclosure Linux Use After Free Memory Corruption Canonical

7.8

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Local authenticated GPU session
Delivery

Submit i915 execbuffer workload
Exploit

Force TTM eviction under memory pressure
Execution

Trigger purge swapping bo->ttm container
Persist

Dereference stale i915_tt pointer (UAF)
Impact

Kernel crash or groomed code execution

Vulnerability Assessment

Weakness	CWE CWE-416 ASVS 5.0 V15 - Secure Coding and Architecture Memory lifecycle management MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires local access with the ability to submit Intel GPU work - specifically issuing i915 GEM execbuffer2 ioctls (CVSS PR:L, AV:L, UI:N), which any logged-in user running a graphical or GPU-compute workload can do. The i915 driver must be loaded (an Intel GPU present and in use); the vulnerable path is the TTM object-purge-on-eviction path, so the trigger requires memory pressure that forces eviction of a busy buffer object marked no-longer-needed (observed under heavy use on DG2 hardware). Limiting factors: it is not remotely reachable, requires an authenticated local session, requires the i915 module, and hinges on a timing/eviction race - so it is not exploitable remotely against default configurations, and reliability is reduced by the need to trigger eviction of a busy, purgeable object at the right moment.
Impact	Signals are internally consistent toward a genuine-but-not-urgent local kernel bug. The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is local, low-privilege, no user interaction, with full CIA impact - appropriate for a kernel UAF, though AC:L likely understates the timing dependence: the crash was observed only under heavy use during eviction, implying a race that in practice is closer to AC:H. EPSS is low (0.21%, 11th percentile) and the issue is NOT in CISA KEV, so there is no evidence of active exploitation; the Linux-attributed report is a bug fix, not an exploit disclosure. No POC is referenced. The realistic risk is a locally-authenticated user (any process able to issue i915 GEM execbuffer ioctls) triggering a reliable crash/DoS, with privilege escalation being plausible but requiring non-trivial heap grooming of a freed slab object under memory pressure. Note the 'Information Disclosure' tag conflicts with the UAF-to-code-execution nature described - the description implies memory corruption/EoP potential, not merely info leak; treat the tag as low-confidence.
Exploit ScenarioDerived	A local unprivileged but GPU-capable user runs a workload that generates heavy Intel GPU memory pressure, forcing TTM eviction of a busy buffer object marked for purge; the stale i915_tt pointer is dereferenced, crashing the kernel (observed GPF) for a reliable local DoS. With careful heap grooming to reclaim the freed page-vector container with attacker-controlled data before the dereference, the UAF could plausibly be steered toward kernel code execution and privilege escalation. No public exploit code is currently identified, and reliable exploitation depends on winning the eviction race.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 20, 2026

Local privilege escalation or denial of service in the Linux kernel's Intel i915 GPU driver stems from a use-after-free in the TTM object purge path (i915_ttm_purge), where the bo->ttm page-vector container can be replaced by ttm_bo_validate() during eviction, leaving a stale i915_tt pointer that is later dereferenced. A user on DG2 (Intel Arc/discrete) hardware reproduced this as a general protection fault under heavy GPU load during buffer-object eviction. There is no public exploit identified at time of analysis and it is not in CISA KEV, with a low EPSS (0.21%), but the CVSS 7.8 local vector reflects high confidentiality, integrity, and availability impact if the freed memory is groomed and reclaimed.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, or mainline 7.1 (or later) - matching your kernel series; the corresponding fix commits are available at git.kernel.org/stable (e.g. df73f3bc731af1c39ac5405bc59c4e7c6f8e9117 and the series-specific backports listed above). For distribution kernels, install the vendor's kernel package that incorporates this fix and reboot. Because the bug is in the i915 driver, systems that do not load i915 (no Intel GPU, or blacklisting the i915 module where a discrete non-Intel GPU is used) are not exposed - blacklisting i915 is a viable compensating control only where Intel graphics are not required, at the cost of losing hardware acceleration on Intel GPUs. There is no practical userspace configuration workaround for systems that depend on i915, since any local client using GEM execbuffer can reach the path; restricting local/untrusted user access reduces exposure but does not eliminate it. Patching is the correct remediation.

Affected VersionsENISA

Linux 7ae034590ceaefd4d37465e3434877acfbadf411 <5c4063c87a619e4df954c179d24628636f5db15f

Linux patch: 6.12.93

Linux 7ae034590ceaefd4d37465e3434877acfbadf411 <073bcbc95e9648c976da1654c7590a8d6ee12c2d

Linux patch: 7.0.12

Linux patch: 6.1.176

Linux patch: 6.6.143

Linux 5.17

Linux patch: 0

Linux 7ae034590ceaefd4d37465e3434877acfbadf411 <28b22dbaf407598cb3bb1d2c586a6f8018690ac2

Linux patch: 6.18.35

Linux 7ae034590ceaefd4d37465e3434877acfbadf411 <c9ae7e7e3bc98615364313b08d7acea5239ded0b

Linux 7ae034590ceaefd4d37465e3434877acfbadf411 <a29654d451bbffe63d584a4cf64ad0efce6bcf1c

Linux patch: 7.1

Linux 7ae034590ceaefd4d37465e3434877acfbadf411 <df73f3bc731af1c39ac5405bc59c4e7c6f8e9117

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw lives in Direct Rendering Manager (DRM) subsystem code for Intel graphics (i915) built on the TTM (Translation Table Maps) memory manager that governs GPU buffer-object (BO) placement between system RAM and VRAM. During get_pages/eviction, i915 calls ttm_bo_validate() to change an object's placement and caching policy; that call can, when the object is still busy and being purged, allocate a fresh i915_tt page-vector container and swap it in for bo->ttm. The buggy code cached a cast of the original bo->ttm to i915_tt before the validate call and reused that stale pointer afterward, dereferencing a file-pointer field of freed memory (the crash RIP is i915_ttm_purge). The root-cause class is a use-after-free (CWE-416, listed N/A in input); the fix re-fetches and re-casts bo->ttm after ttm_bo_validate() so the correct, live container is used. CPE data identifies the affected component as cpe:2.3:a:linux:linux, i.e. the mainline Linux kernel i915 driver.

Know when Canonical gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 7.0 HIGH

Local GPU-capable user (AV:L/PR:L); triggering the UAF needs an eviction/purge race under memory pressure (AC:H); a successful kernel UAF yields full CIA impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE HIGH

Red Hat 7.0 HIGH

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 17:19 EUVD

CVE Published

Jul 19, 2026 - 14:54 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 14:54 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/i915: Fix potential UAF in TTM object purge

TLDR: The bo->ttm object might be changed by calling ttm_bo_validate(), move casting it to an i915_tt object later to actually get the right pointer.

A user reported hitting the following bug under heavy use on DG2:

[26620.095550] Oops: general protection fault, probably for non-canonical address 0xa56b6b6b6b6b6b8b: 0000 1 SMP NOPTI [26620.095556] CPU: 2 UID: 0 PID: 631 Comm: Xorg Not tainted 6.18.8 #1 PREEMPT(lazy) [26620.095558] Hardware name: ASRock B850M Steel Legend WiFi/B850M Steel Legend WiFi, BIOS 3.50 09/18/2025 [26620.095559] RIP: 0010:i915_ttm_purge+0x84/0x100 [i915] [26620.095604] Code: 00 00 00 48 8d 54 24 10 48 89 e6 48 89 fb e8 83 aa ae ff 85 c0 75 6f 48 83 bb a8 01 00 00 00 74 2c 48 8b 45 78 48 85 c0 74 23 <48> 8b 78 20 48 c7 c2 ff ff ff ff 31 f6 e8 7a 73 e3 e0 48 8b 7d 78 [26620.095605] RSP: 0018:ffffc90005fd7430 EFLAGS: 00010282 [26620.095607] RAX: a56b6b6b6b6b6b6b RBX: ffff8881f46c3dc0 RCX: 0000000000000000 [26620.095608] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 00000000ffffffff [26620.095609] RBP: ffff888289610f00 R08: 0000000000000001 R09: ffff88823b022000 [26620.095609] R10: ffff888103029b28 R11: ffff8881fc7f3800 R12: ffff88810b6150d0 [26620.095609] R13: ffff888289610f00 R14: 0000000000000000 R15: ffff8881f46c3dc0 [26620.095610] FS: 00007f1004d86900(0000) GS:ffff88901c858000(0000) knlGS:0000000000000000 [26620.095611] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [26620.095611] CR2: 00007f0fdf489000 CR3: 000000035b0c1000 CR4: 0000000000750ef0 [26620.095612] PKRU: 55555554 [26620.095612] Call Trace: [26620.095615] <TASK> [26620.095615] i915_ttm_move+0x2b9/0x420 [i915] [26620.095642] ? ttm_tt_init+0x65/0x80 [ttm] [26620.095644] ? i915_ttm_tt_create+0xc6/0x150 [i915] [26620.095667] ttm_bo_handle_move_mem+0xb6/0x160 [ttm] [26620.095669] ttm_bo_evict+0x100/0x150 [ttm] [26620.095671] ? preempt_count_add+0x64/0xa0 [26620.095673] ? _raw_spin_lock+0xe/0x30 [26620.095675] ? _raw_spin_unlock+0xd/0x30 [26620.095675] ? i915_gem_object_evictable+0xb7/0xd0 [i915] [26620.095704] ttm_bo_evict_cb+0x6e/0xd0 [ttm] [26620.095705] ttm_lru_walk_for_evict+0xa6/0x200 [ttm] [26620.095708] ttm_bo_alloc_resource+0x185/0x4f0 [ttm] [26620.095709] ? init_object+0x62/0xd0 [26620.095712] ttm_bo_validate+0x7a/0x180 [ttm] [26620.095713] ? _raw_spin_unlock_irqrestore+0x16/0x30 [26620.095714] __i915_ttm_get_pages+0xb0/0x170 [i915] [26620.095737] i915_ttm_get_pages+0x9f/0x150 [i915] [26620.095759] ? i915_gem_do_execbuffer+0xedc/0x2b40 [i915] [26620.095786] ? alloc_debug_processing+0xd0/0x100 [26620.095787] ? _raw_spin_unlock_irqrestore+0x16/0x30 [26620.095788] ? i915_vma_instance+0xa0/0x4e0 [i915] [26620.095822] __i915_gem_object_get_pages+0x2f/0x40 [i915] [26620.095848] i915_vma_pin_ww+0x706/0x980 [i915] [26620.095875] ? i915_gem_do_execbuffer+0xedc/0x2b40 [i915] [26620.095904] eb_validate_vmas+0x170/0xa00 [i915] [26620.095930] i915_gem_do_execbuffer+0x1201/0x2b40 [i915] [26620.095953] ? alloc_debug_processing+0xd0/0x100 [26620.095954] ? _raw_spin_unlock_irqrestore+0x16/0x30 [26620.095955] ? i915_gem_execbuffer2_ioctl+0xc9/0x240 [i915] [26620.095977] ? __wake_up_sync_key+0x32/0x50 [26620.095979] ? i915_gem_execbuffer2_ioctl+0xc9/0x240 [i915] [26620.096001] ? __slab_alloc.isra.0+0x67/0xc0 [26620.096003] i915_gem_execbuffer2_ioctl+0x11a/0x240 [i915]

Results from decode_stacktrace.sh pointed to dereference of a file pointer field of a i915 TTM page vector container associated with an object being purged on eviction. That path is taken when the object is marked as no longer needed.

Code analysis revealed a possibility of the i915 TTM page vector container being replaced with a new instance inside a function that purges content of the object, should it be still busy. That function is called, indirectly via a more general function that changes the object's placement and caching policy, ---truncated---

Executive ViewAI

Why It Matters

Intel Arc GPU driver (i915) contains a use-after-free vulnerability on Linux that enables local privilege escalation and denial of service. Organizations with Intel Arc discrete graphics face direct risk to system access control and availability. Prompt patching of affected systems is critical to mitigate this risk.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 89% exploitable

Prevalence

Ubiquitous

Linux kernel with the i915 Intel GPU driver runs on most Linux desktops/laptops

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Canonical

View all

CVE-2011-3544 CRITICAL Act Now POC

9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug

CVE-2019-11043 CRITICAL Emergency POC

9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2014-6271 CRITICAL Act Now POC

9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

CVE-2013-0422 CRITICAL Emergency POC

9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using

CVE-2016-3714 HIGH Act Now POC

8.4 May 05

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.

CVE-2017-12617 HIGH Act Now POC

8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT

CVE-2016-8735 CRITICAL Act Now POC

9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8

CVE-2014-7169 CRITICAL Act Now POC

9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

CVE-2014-0160 HIGH Act Now POC

7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

CVE-2016-5195 HIGH Act Now POC

7.0 Nov 10

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

CVE-2013-2423 LOW Act Now POC

3.7 Apr 17

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and

CVE-2023-4911 HIGH Act Now POC

7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2009-4324 HIGH POC

7.8

CVE-2015-0313 CRITICAL POC

9.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2013-2551 HIGH POC

8.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-63884 ADVISORY https://seclists.org/oss-sec/2026/q3/230 ADVISORY https://ubuntu.com/security/notices/USN-8593-1 ADVISORY https://vuldb.com/vuln/380324 REF https://git.kernel.org/stable/c/073bcbc95e9648c976da1654c7590a8d6ee12c2d REF https://git.kernel.org/stable/c/28b22dbaf407598cb3bb1d2c586a6f8018690ac2 REF https://git.kernel.org/stable/c/5c4063c87a619e4df954c179d24628636f5db15f REF https://git.kernel.org/stable/c/a29654d451bbffe63d584a4cf64ad0efce6bcf1c REF https://git.kernel.org/stable/c/c9ae7e7e3bc98615364313b08d7acea5239ded0b REF https://git.kernel.org/stable/c/df73f3bc731af1c39ac5405bc59c4e7c6f8e9117

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back