In the Linux kernel, the following vulnerability has been resolved:
drm/i915: Fix potential overflow of shmem scatterlist length
When a scatterlists table of a GEM shmem object of size 4 GB or more is populated with pages allocated from a folio, unsigned int .length attribute of a scatterlist may get overflowed if total byte length of pages allocated to that single scatterlist happens to reach or cross the 4GB limit. As a consequence, users of the object may suffer from hitting unexpected, premature end of the object's backing pages.
[278.780187] ------------[ cut here ]------------ [278.780377] WARNING: CPU: 1 PID: 2326 at drivers/gpu/drm/i915/i915_mm.c:55 remap_sg+0x199/0x1d0 [i915] ... [278.780654] CPU: 1 UID: 0 PID: 2326 Comm: gem_mmap_offset Tainted: G S U 6.17.0-rc1-CI_DRM_16981-ged823aaa0607+ #1 PREEMPT(voluntary) [278.780656] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER [278.780658] Hardware name: Intel Corporation Meteor Lake Client Platform/MTL-P LP5x T3 RVP, BIOS MTLPFWI1.R00.3471.D91.2401310918 01/31/2024 [278.780659] RIP: 0010:remap_sg+0x199/0x1d0 [i915] ... [278.780786] Call Trace: [278.780787] <TASK> [278.780788] ? __apply_to_page_range+0x3e6/0x910 [278.780795] ? __pfx_remap_sg+0x10/0x10 [i915] [278.780906] apply_to_page_range+0x14/0x30 [278.780908] remap_io_sg+0x14d/0x260 [i915] [278.781013] vm_fault_cpu+0xd2/0x330 [i915] [278.781137] __do_fault+0x3a/0x1b0 [278.781140] do_fault+0x322/0x640 [278.781143] __handle_mm_fault+0x938/0xfd0 [278.781150] handle_mm_fault+0x12c/0x300 [278.781152] ? lock_mm_and_find_vma+0x4b/0x760 [278.781155] do_user_addr_fault+0x2d6/0x8e0 [278.781160] exc_page_fault+0x96/0x2c0 [278.781165] asm_exc_page_fault+0x27/0x30 ...
That issue was apprehended by the author of a change that introduced it, and potential risk even annotated with a comment, but then never addressed.
When adding folio pages to a scatterlist table, take care of byte length of any single scatterlist not exceeding max_segment.
(cherry picked from commit 06249b4e691a75694c014a61708c007fb5755f60)
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Aug 4, 2026 | May 8, 2026 |
| Rocky_linux | — | Upgrade kernel-debuginfoUpgrade kernel-modulesUpgrade kernel-rt-debug-debuginfoUpgrade kernel-zfcpdump-modules-extraUpgrade rvUpgrade kernel-debuginfo-common-s390xUpgrade kernel-modules-coreUpgrade kernel-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debugUpgrade kernel-rt-debug-develUpgrade kernel-rt-develUpgrade kernel-zfcpdumpUpgrade kernel-tools-debuginfoUpgrade kernel-toolsUpgrade kernel-debug-modules-coreUpgrade kernel-debug-develUpgrade kernel-tools-libsUpgrade kernel-modules-extraUpgrade rtlaUpgrade kernel-debug-coreUpgrade kernel-modules-extra-matchedUpgrade perf-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rtUpgrade kernel-uki-virt-addonsUpgrade kernel-debug-debuginfoUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debugUpgrade kernel-debug-modulesUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-develUpgrade python3-perf-debuginfoUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-devel-matchedUpgrade kernel-debug-devel-matchedUpgrade kernel-develUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade python3-perfUpgrade libperf-debuginfoUpgrade libperfUpgrade perfUpgrade kernelUpgrade kernel-rt-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdump-core | Sep 17, 2026 | Sep 15, 2026 |
| Ubuntu | — | Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-azure-fde-6.8Upgrade linux-image-fips-6.8Upgrade linux-image-gke-64k-6.8Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-oem-20.04Upgrade linux-image-oem-20.04dUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-6.8.0-1059-nvidiaUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1064-gcpUpgrade linux-image-gkeopUpgrade linux-image-6.8.0-1059-gke-64kUpgrade linux-image-xilinxUpgrade linux-image-gke-6.8Upgrade linux-image-oem-20.04cUpgrade linux-image-oem-22.04aUpgrade linux-image-generic-6.8Upgrade linux-image-azureUpgrade linux-image-oem-22.04bUpgrade linux-image-genericUpgrade linux-image-raspi-6.8Upgrade linux-image-nvidia-tegraUpgrade linux-image-oem-22.04dUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-xilinx-6.8Upgrade linux-image-6.8.0-136-genericUpgrade linux-image-gcpUpgrade linux-image-virtualUpgrade linux-image-aws-6.8Upgrade linux-image-6.8.0-1063-azureUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-oracle-64kUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-1058-oracle-64kUpgrade linux-image-6.8.0-2050-raspi-realtimeUpgrade linux-image-azure-6.8Upgrade linux-image-6.8.0-1063-azure-fipsUpgrade linux-image-nvidiaUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-6.8.0-136-lowlatency-64kUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-generic-64kUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-6.8.0-136-fipsUpgrade linux-image-laptop-23.10Upgrade linux-image-6.8.0-1059-nvidia-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-1061-ibmUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.8.0-1030-nvidia-tegraUpgrade linux-image-6.8.0-1058-oracleUpgrade linux-image-oem-20.04bUpgrade linux-image-oem-22.04Upgrade linux-image-azure-fips-6.8Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-nvidia-64kUpgrade linux-image-oracle-6.8Upgrade linux-image-ibmUpgrade linux-image-intel-iotgUpgrade linux-image-gkeUpgrade linux-image-lowlatency-64kUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-nvidia-tegra-6.8Upgrade linux-image-6.8.0-1059-gkeUpgrade linux-image-realtime-6.8.1Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-lowlatencyUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-aws-64kUpgrade linux-image-6.8.0-1061-aws-fipsUpgrade linux-image-6.8.0-136-generic-64kUpgrade linux-image-awsUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-136-lowlatencyUpgrade linux-image-aws-fips-6.8Upgrade linux-image-6.8.0-1059-nvidia-lowlatencyUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-generic-64k-6.8Upgrade linux-image-gcp-6.8Upgrade linux-image-kvmUpgrade linux-image-gcp-64kUpgrade linux-image-azure-fipsUpgrade linux-image-aws-fipsUpgrade linux-image-ibm-6.8Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-nvidia-tegra-rtUpgrade linux-image-gkeop-6.8Upgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-6.8.1-1056-realtimeUpgrade linux-image-6.8.0-1033-xilinxUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-virtual-6.8Upgrade linux-image-realtimeUpgrade linux-image-6.8.0-1062-azure-fdeUpgrade linux-image-6.8.0-1061-raspiUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.8.0-1064-gcp-fipsUpgrade linux-image-6.8.0-1046-gkeopUpgrade linux-image-6.8.0-1061-awsUpgrade linux-image-6.8.0-1030-nvidia-tegra-rtUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-aws-64k-6.8Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-raspiUpgrade linux-image-nvidia-tegra-rt-6.8Upgrade linux-image-gke-64kUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-lowlatency-6.8Upgrade linux-image-azure-lts-24.04Upgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1061-aws-64kUpgrade linux-image-6.8.0-1059-nvidia-lowlatency-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-gcp-fipsUpgrade linux-image-fipsUpgrade linux-image-6.8.0-1064-gcp-64kUpgrade linux-image-oracle | Jul 21, 2026 | Jul 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub