In the Linux kernel, the following vulnerability has been resolved:
drm/i915: Fix potential overflow of shmem scatterlist length
When a scatterlists table of a GEM shmem object of size 4 GB or more is populated with pages allocated from a folio, unsigned int .length attribute of a scatterlist may get overflowed if total byte length of pages allocated to that single scatterlist happens to reach or cross the 4GB limit. As a consequence, users of the object may suffer from hitting unexpected, premature end of the object's backing pages.
[278.780187] ------------[ cut here ]------------ [278.780377] WARNING: CPU: 1 PID: 2326 at drivers/gpu/drm/i915/i915_mm.c:55 remap_sg+0x199/0x1d0 [i915] ... [278.780654] CPU: 1 UID: 0 PID: 2326 Comm: gem_mmap_offset Tainted: G S U 6.17.0-rc1-CI_DRM_16981-ged823aaa0607+ #1 PREEMPT(voluntary) [278.780656] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER [278.780658] Hardware name: Intel Corporation Meteor Lake Client Platform/MTL-P LP5x T3 RVP, BIOS MTLPFWI1.R00.3471.D91.2401310918 01/31/2024 [278.780659] RIP: 0010:remap_sg+0x199/0x1d0 [i915] ... [278.780786] Call Trace: [278.780787] <TASK> [278.780788] ? __apply_to_page_range+0x3e6/0x910 [278.780795] ? __pfx_remap_sg+0x10/0x10 [i915] [278.780906] apply_to_page_range+0x14/0x30 [278.780908] remap_io_sg+0x14d/0x260 [i915] [278.781013] vm_fault_cpu+0xd2/0x330 [i915] [278.781137] __do_fault+0x3a/0x1b0 [278.781140] do_fault+0x322/0x640 [278.781143] __handle_mm_fault+0x938/0xfd0 [278.781150] handle_mm_fault+0x12c/0x300 [278.781152] ? lock_mm_and_find_vma+0x4b/0x760 [278.781155] do_user_addr_fault+0x2d6/0x8e0 [278.781160] exc_page_fault+0x96/0x2c0 [278.781165] asm_exc_page_fault+0x27/0x30 ...
That issue was apprehended by the author of a change that introduced it, and potential risk even annotated with a comment, but then never addressed.
When adding folio pages to a scatterlist table, take care of byte length of any single scatterlist not exceeding max_segment.
(cherry picked from commit 06249b4e691a75694c014a61708c007fb5755f60)
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-coreUpgrade kernel-debug-modulesUpgrade kernel-rt-modulesUpgrade kernel-64k-modules-coreUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-headersUpgrade perfUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-64k-coreUpgrade kernel-debug-uki-virtUpgrade kernel-debug-coreUpgrade kernel-rt-64k-modules-coreUpgrade kernel-64k-coreUpgrade libperfUpgrade kernel-rt-debug-modules-extraUpgrade kernel-develUpgrade kernel-64k-debug-develUpgrade kernel-64k-debug-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade rtlaUpgrade kernel-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-64k-develUpgrade kernel-debug-modules-extraUpgrade kernel-docUpgrade kernel-debug-develUpgrade kernel-tools-libsUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-rt-debugUpgrade kernel-debugUpgrade kernel-modules-coreUpgrade kernel-modulesUpgrade kernel-uki-virtUpgrade kernel-coreUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdumpUpgrade kernel-tools-libs-develUpgrade kernel-rt-develUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-64k-debugUpgrade python3-perfUpgrade kernel-cross-headersUpgrade kernelUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-64k-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-debug-devel-matchedUpgrade kernel-uki-virt-addonsUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-64k-debug-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-64kUpgrade kernel-rt-64k-modules-extraUpgrade rvUpgrade kernel-zfcpdump-modulesUpgrade kernel-64k-modules-extraUpgrade kernel-toolsUpgrade kernel-rt-64k-develUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-rt-64kUpgrade kernel-rtUpgrade kernel-rt-64k-debug-develUpgrade kernel-64k-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-abi-stablelistsUpgrade kernel-64k-debug-coreUpgrade kernel-64k-debug-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-rt-64k-debug | Oct 11, 2026 | Sep 14, 2026 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Aug 4, 2026 | May 8, 2026 |
| Rocky_linux | — | Upgrade kernel-develUpgrade kernel-tools-libs-develUpgrade kernel-devel-matchedUpgrade kernel-debug-devel-matchedUpgrade libperfUpgrade kernel-zfcpdump-debuginfoUpgrade kernelUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade libperf-debuginfoUpgrade python3-perfUpgrade perfUpgrade kernel-rt-coreUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-debuginfo-common-s390xUpgrade kernel-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-debuginfoUpgrade kernel-modulesUpgrade kernel-debug-coreUpgrade rvUpgrade kernel-rt-modulesUpgrade kernel-debug-uki-virtUpgrade rtlaUpgrade kernel-tools-debuginfoUpgrade kernel-toolsUpgrade kernel-debug-modules-coreUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debugUpgrade kernel-debug-develUpgrade kernel-debugUpgrade kernel-rt-debug-modulesUpgrade kernel-modules-extraUpgrade kernel-rt-modules-coreUpgrade kernel-rt-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-develUpgrade kernel-coreUpgrade kernel-debug-modules-extraUpgrade perf-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debuginfoUpgrade kernel-rtUpgrade kernel-debug-modulesUpgrade kernel-uki-virt-addonsUpgrade kernel-debug-debuginfoUpgrade kernel-uki-virtUpgrade kernel-modules-extra-matchedUpgrade kernel-modules-core | Sep 17, 2026 | Sep 15, 2026 |
| Ubuntu | — | Upgrade linux-image-gcp-fipsUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-1061-aws-64kUpgrade linux-image-6.8.0-1059-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1030-nvidia-tegra-rtUpgrade linux-image-lowlatency-6.8Upgrade linux-image-azure-lts-24.04Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-aws-64k-6.8Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-ibm-classicUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-realtimeUpgrade linux-image-awsUpgrade linux-image-kvmUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-virtual-6.8Upgrade linux-image-azure-fipsUpgrade linux-image-gcp-64kUpgrade linux-image-6.8.0-1033-xilinxUpgrade linux-image-generic-64k-6.8Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.0-1059-nvidia-lowlatencyUpgrade linux-image-gcp-6.8Upgrade linux-image-ibm-6.8Upgrade linux-image-generic-lpaeUpgrade linux-image-aws-fipsUpgrade linux-image-6.8.0-1062-azure-fdeUpgrade linux-image-6.8.0-1046-gkeopUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-aws-fips-6.8Upgrade linux-image-6.8.0-1061-raspiUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-6.8.0-1064-gcp-64kUpgrade linux-image-fipsUpgrade linux-image-6.8.1-1056-realtimeUpgrade linux-image-gkeop-6.8Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-oracleUpgrade linux-image-azure-fdeUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.8.0-136-lowlatencyUpgrade linux-image-nvidia-tegra-rt-6.8Upgrade linux-image-raspiUpgrade linux-image-gke-64kUpgrade linux-image-6.8.0-1064-gcp-fipsUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-6.8.0-1061-awsUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-oem-22.04aUpgrade linux-image-oem-20.04cUpgrade linux-image-lowlatencyUpgrade linux-image-aws-lts-24.04Upgrade linux-image-aws-6.8Upgrade linux-image-virtualUpgrade linux-image-aws-64kUpgrade linux-image-6.8.0-136-generic-64kUpgrade linux-image-genericUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1061-aws-fipsUpgrade linux-image-6.8.0-1030-nvidia-tegraUpgrade linux-image-6.8.0-2050-raspi-realtimeUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-6.8.0-1064-gcpUpgrade linux-image-oem-22.04dUpgrade linux-image-nvidia-tegraUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-gcpUpgrade linux-image-6.8.0-136-genericUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-raspi-6.8Upgrade linux-image-xilinx-6.8Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-gkeUpgrade linux-image-6.8.0-1059-gkeUpgrade linux-image-lowlatency-64kUpgrade linux-image-intel-iotgUpgrade linux-image-nvidia-tegra-6.8Upgrade linux-image-ibmUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oracle-64kUpgrade linux-image-raspi-realtimeUpgrade linux-image-6.8.0-1063-azure-fipsUpgrade linux-image-azure-6.8Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-1061-ibmUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-6.8.0-1059-nvidia-64kUpgrade linux-image-realtime-6.8.1Upgrade linux-image-oracle-6.8Upgrade linux-image-oem-22.04Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1063-azureUpgrade linux-image-generic-64kUpgrade linux-image-laptop-23.10Upgrade linux-image-6.8.0-136-fipsUpgrade linux-image-oem-20.04bUpgrade linux-image-6.8.0-1058-oracle-64kUpgrade linux-image-6.8.0-1058-oracleUpgrade linux-image-azure-fips-6.8Upgrade linux-image-gke-6.8Upgrade linux-image-oem-22.04bUpgrade linux-image-oem-20.04dUpgrade linux-image-xilinxUpgrade linux-image-azure-fde-6.8Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-oem-22.04cUpgrade linux-image-gke-64k-6.8Upgrade linux-image-fips-6.8Upgrade linux-image-6.8.0-1059-nvidiaUpgrade linux-image-6.8.0-1059-gke-64kUpgrade linux-image-6.8.0-136-lowlatency-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-oem-20.04Upgrade linux-image-azureUpgrade linux-image-generic-6.8Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-gkeop | Jul 21, 2026 | Jul 20, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub