{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2026-43368", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-43368", "idYear": 2026, "status": "PUBLISHED", "publishedAt": "2026-05-08T14:21:20.500Z", "updatedAt": "2026-10-19T19:16:27.757Z", "importedAt": "2026-10-24T01:58:14.884Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "drm/i915: Fix potential overflow of shmem scatterlist length", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: Fix potential overflow of shmem scatterlist length\n\nWhen a scatterlists table of a GEM shmem object of size 4 GB or more is\npopulated with pages allocated from a folio, unsigned int .length\nattribute of a scatterlist may get overflowed if total byte length of\npages allocated to that single scatterlist happens to reach or cross the\n4GB limit. As a consequence, users of the object may suffer from hitting\nunexpected, premature end of the object's backing pages.\n\n[278.780187] ------------[ cut here ]------------\n[278.780377] WARNING: CPU: 1 PID: 2326 at drivers/gpu/drm/i915/i915_mm.c:55 remap_sg+0x199/0x1d0 [i915]\n...\n[278.780654] CPU: 1 UID: 0 PID: 2326 Comm: gem_mmap_offset Tainted: G S U 6.17.0-rc1-CI_DRM_16981-ged823aaa0607+ #1 PREEMPT(voluntary)\n[278.780656] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER\n[278.780658] Hardware name: Intel Corporation Meteor Lake Client Platform/MTL-P LP5x T3 RVP, BIOS MTLPFWI1.R00.3471.D91.2401310918 01/31/2024\n[278.780659] RIP: 0010:remap_sg+0x199/0x1d0 [i915]\n...\n[278.780786] Call Trace:\n[278.780787] \n[278.780788] ? __apply_to_page_range+0x3e6/0x910\n[278.780795] ? __pfx_remap_sg+0x10/0x10 [i915]\n[278.780906] apply_to_page_range+0x14/0x30\n[278.780908] remap_io_sg+0x14d/0x260 [i915]\n[278.781013] vm_fault_cpu+0xd2/0x330 [i915]\n[278.781137] __do_fault+0x3a/0x1b0\n[278.781140] do_fault+0x322/0x640\n[278.781143] __handle_mm_fault+0x938/0xfd0\n[278.781150] handle_mm_fault+0x12c/0x300\n[278.781152] ? lock_mm_and_find_vma+0x4b/0x760\n[278.781155] do_user_addr_fault+0x2d6/0x8e0\n[278.781160] exc_page_fault+0x96/0x2c0\n[278.781165] asm_exc_page_fault+0x27/0x30\n...\n\nThat issue was apprehended by the author of a change that introduced it,\nand potential risk even annotated with a comment, but then never addressed.\n\nWhen adding folio pages to a scatterlist table, take care of byte length\nof any single scatterlist not exceeding max_segment.\n\n(cherry picked from commit 06249b4e691a75694c014a61708c007fb5755f60)", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "0b62af28f249b9c4036a05acfb053058dc02e2e2", "status": "affected", "versionType": "git", "lessThan": "aeb7255531ba4a5c3a64938577170d08b78de399" }, { "version": "0b62af28f249b9c4036a05acfb053058dc02e2e2", "status": "affected", "versionType": "git", "lessThan": "1c956f0fccc26fefcbb507516c49d1db41c40471" }, { "version": "0b62af28f249b9c4036a05acfb053058dc02e2e2", "status": "affected", "versionType": "git", "lessThan": "eae4bf4107571283031db96ce132e951615e2ae4" }, { "version": "0b62af28f249b9c4036a05acfb053058dc02e2e2", "status": "affected", "versionType": "git", "lessThan": "21a301f12d18797bf889c15497f922edfdaece3a" }, { "version": "0b62af28f249b9c4036a05acfb053058dc02e2e2", "status": "affected", "versionType": "git", "lessThan": "029ae067431ab9d0fca479bdabe780fa436706ea" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "6.5", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "6.5" }, { "version": "6.6.130", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.6.*" }, { "version": "6.12.78", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.12.*" }, { "version": "6.18.19", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.18.*" }, { "version": "6.19.9", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.19.*" }, { "version": "7.0", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }