Linux kernel drm/i915: HDCP stream array bounds check ran after the overflowing write
Impact
In the i915 HDCP path the overflow check on data->streams[] was performed after the write that overflows it, so the out-of-bounds write had already happened by the time the warning fired. The fix moves the check ahead of the write. Exposure is narrow: this is the display content-protection path, which requires a local user on a machine driving HDCP-capable outputs through i915. On a headless GPU compute node there is no display pipe running HDCP and this code is not reached, so for most datacenter fleets this is a routine kernel update rather than a maintenance-window event. It matters more on i915-backed workstations or remote-desktop hosts that actually light up displays. The issue was found by AI-assisted static analysis and confirmed by Intel Product Security.
Who can reach it
A local user on a host with an i915 display device active on an HDCP-capable output. Not reachable over the network and not reachable on a headless server configuration.
What to do
Pick up the fix from the stable trees listed in the record and reboot into the new kernel; there is no module-reload path that avoids a reboot for a live GPU driver. Because the exposure is display-only, most datacenter operators can fold this into the next scheduled kernel roll rather than draining nodes for it. No CVSS-relevant mitigation is offered beyond the patch.
References
Related entries
- Linux kernel drm/xe: unreset current_op on vm_bind retry overflows the page-table op arrayCVE-2026-68264 · Linux kernel drm/xe page-table update ops (xe_pt_update_ops_init)High
- Linux kernel drm/xe: imported dma-buf BO can outlive the exporter, giving a use-after-free on the shared resvCVE-2026-68266 · Linux kernel drm/xe dma-buf import (xe_bo_init_locked)High
- Linux kernel amdgpu RAS / GPU reset and recovery path (drm/amdgpu): A use-after-free in the amdgpu RAS / GPU reset andCVE-2026-68273 · Linux kernel amdgpu RAS / GPU reset and recovery path (drm/amdgpu)High
- Linux kernel drm/xe GuC: steered register list sized from geometry DSS mask only, overflowing the bufferCVE-2026-68274 · Linux kernel drm/xe GuC steered register list allocationHigh
- Linux kernel drm/xe: SVM state and pagemaps leak on the xe_vm_create() error pathCVE-2026-68298 · Linux kernel drm/xe VM creation (xe_vm_create SVM error unwind)High
- Linux kernel drm/xe VF: NULL dereference detaching CCS buffers after the device is unboundCVE-2026-68305 · Linux kernel drm/xe SR-IOV VF CCS buffer detach (xe_sriov_vf_ccs_detach_bo)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.