Linux kernel drm/i915: HDCP stream array bounds check ran after the overflowing write
Impact
In the i915 HDCP path the overflow check on data->streams[] was performed after the write that overflows it, so the out-of-bounds write had already happened by the time the warning fired. The fix moves the check ahead of the write. Exposure is narrow: this is the display content-protection path, which requires a local user on a machine driving HDCP-capable outputs through i915. On a headless GPU compute node there is no display pipe running HDCP and this code is not reached, so for most datacenter fleets this is a routine kernel update rather than a maintenance-window event. It matters more on i915-backed workstations or remote-desktop hosts that actually light up displays. The issue was found by AI-assisted static analysis and confirmed by Intel Product Security.
Who can reach it
A local user on a host with an i915 display device active on an HDCP-capable output. Not reachable over the network and not reachable on a headless server configuration.
What to do
Pick up the fix from the stable trees listed in the record and reboot into the new kernel; there is no module-reload path that avoids a reboot for a live GPU driver. Because the exposure is display-only, most datacenter operators can fold this into the next scheduled kernel roll rather than draining nodes for it. No CVSS-relevant mitigation is offered beyond the patch.
References
Related entries
- Linux kernel amdgpu RAS / GPU reset and recovery path (drm/amdgpu): A use-after-free in the amdgpu RAS / GPU reset andCVE-2026-68273 · Linux kernel amdgpu RAS / GPU reset and recovery path (drm/amdgpu)High
- Linux kernel vmwgfx: surface array_size taken from userspace without a shader-model boundCVE-2026-68446 · Linux kernel drm/vmwgfx (vmw_surface_metadata::array_size validation)High
- NVIDIA/Mellanox ConnectX driver (mlx5_ib user access region index release): The driver released the software-side UARCVE-2026-74296 · NVIDIA/Mellanox ConnectX driver (mlx5_ib user access region index release)High
- Linux kernel amdgpu RAS / GPU reset and recovery path (drm/amdgpu): An out-of-bounds access in the amdgpu RAS / GPUCVE-2026-74357 · Linux kernel amdgpu RAS / GPU reset and recovery path (drm/amdgpu)High
- Linux kernel vmwgfx: undersized DRAW_PRIMITIVES header wraps the bound into an out-of-bounds readCVE-2026-74444 · Linux kernel drm/vmwgfx (vmw_cmd_draw DRAW_PRIMITIVES header size)High
- Linux kernel amdgpu display core (DC/DM) (drm/amd/display): An out-of-bounds access in the amdgpu display core (DC/DM)CVE-2026-74449 · Linux kernel amdgpu display core (DC/DM) (drm/amd/display)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.