GPU VulnDB

Database/NVIDIA / GPU stack

drm/i915: scatterlist length overflows for GEM shmem objects of 4 GB or more

CVSS 7.8CVE-2026-43368NVIDIA / GPU stackcurated

Impact

When the scatterlist table for an i915 GEM shmem object of 4 GB or more is populated from folio-allocated pages, the unsigned-int length field of a single scatterlist entry can overflow once the pages assigned to it reach the 4 GB mark. Users of the object then hit a premature end of its backing pages; the upstream report shows a WARN in remap_sg() reached through a CPU fault path from a userspace gem_mmap_offset test, so the observed outcome is a kernel warning and mishandled mappings rather than a proven write primitive. It matters wherever Intel GPUs are in the fleet - Intel Data Center GPU parts and any node where i915 drives the display or compute device - because large buffers are exactly what AI workloads allocate, and the trigger is an ordinary unprivileged allocation, not a crafted one. The flaw was known to the author of the code that introduced it and annotated in a comment, then left unaddressed, so it has been latent across several releases.

Who can reach it

Local user with access to the DRM render node (/dev/dri/renderD*), which on GPU nodes is any pod granted the device. No authentication beyond that; the path is reached by allocating a GEM shmem object of 4 GB or more and faulting it in.

What to do

Update to a stable kernel that caps per-scatterlist byte length at max_segment (five branches carry the backport, and the fix is a cherry-pick of upstream 06249b4e691a) then drain and reboot the node - i915 cannot be unloaded while workloads hold the device. Nodes with no Intel GPU and no i915 in lsmod can skip it. No Intel advisory is present in the record, so no fixed product version is quoted here.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-43368https://git.kernel.org/stable/c/029ae067431ab9d0fca479bdabe780fa436706eahttps://git.kernel.org/stable/c/1c956f0fccc26fefcbb507516c49d1db41c40471https://git.kernel.org/stable/c/21a301f12d18797bf889c15497f922edfdaece3a

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.