Look up another CVE · open CVE-2026-53356 in the interactive tracker
CVE-2026-53356
drm/i915/gem: Fix phys BO pread/pwrite with offset
Published 2026-07-01 (4 months ago) by the Linux kernel CNA. Subsystem drivers/gpu. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-53356 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4665-1 · 2026-07-03 · text | 6.1.176-1 | Update the kernel and reboot. DLA-4665-1 shipped the fix on 2026-07-03, in 6.1.176-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.94-1 | Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.13-1 | Update the kernel and reboot. Fixed in 7.0.13-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.13-1 | Update the kernel and reboot. Fixed in 7.0.13-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
sg_page() returns struct page pointer not (void *) so the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO would be accessed if non-zero offset is used. Last impacted platform with overlay or cursor planes using phys mapping was Gen3/945G/Lakeport. (cherry picked from commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6)
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/gpu/drm/i915/gem/i915_gem_phys.c
- What this is
- INTEL DRM I915 DRIVER (Meteor Lake, DG2 and older excluding Poulsbo, Moorestown and derivative)MAINTAINERS section matched on drivers/gpu/drm/i915/ · intel-gfx@lists.freedesktop.org · Supported
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-07-01 (4 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/gpu
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.7 | 5.10.259 | 40f738991058 |
| 5.7 | 5.15.210 | 1ec8fc63e9cd |
| 5.7 | 6.1.176 | 14469860e2e3 |
| 5.7 | 6.6.143 | 07c33be968d9 |
| 5.7 | 6.12.94 | 3bd168dd835b |
| 5.7 | 6.18.36 | 32d4c5d328a3 |
| 5.7 | 7.0.13 | dd51a2eeb93b |
| 5.7 | 7.1 | d21ad938398b |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4671-1 | 2026-07-05 | bullseye 6.1.176-1~deb11u1 | tracker |
| DLA-4665-1 | 2026-07-03 | bookworm 6.1.176-1 | tracker |
| DLA-4664-1 | 2026-07-03 | bullseye 5.10.259-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerable path is reached through local DRM/i915 ioctls, specifically GEM pread/pwrite on a phys-backed buffer object. It is not reachable from network, adjacent, or physical device input.
- AC:LAttack complexity, low
- Once on an affected legacy i915 platform with a phys-backed cursor/overlay BO, a nonzero offset reliably triggers the bad scaled pointer arithmetic. There is no race or attacker-external timing condition.
- PR:LPrivileges required, low
- The attacker needs local access to the DRM device and enough ordinary DRM/KMS access to create and pin a framebuffer-backed GEM object, but not real root or CAP_SYS_ADMIN. The pread/pwrite ioctls themselves are render-allowed.
- UI:NUser interaction, none
- No victim action is required after the attacker has local DRM access. The attacker can issue the needed ioctls directly.
- S:UScope, unchanged
- The vulnerability is a kernel memory access bug reachable from a kernel driver ioctl path. It does not cross a separate security authority such as a VM host boundary.
- C:HConfidentiality impact, high
- The faulty phys BO pread path can copy out-of-bounds kernel memory back to userspace. This is a high confidentiality impact because it can disclose kernel memory beyond the intended buffer.
- I:HIntegrity impact, high
- The faulty phys BO pwrite path can copy attacker-controlled data out of bounds into kernel memory relative to the coherent allocation. This is kernel memory corruption and can plausibly be leveraged for privilege escalation.
- A:HAvailability impact, high
- The out-of-bounds read/write can corrupt or access invalid kernel memory and cause an oops, panic, or hang. Repeated triggering is possible through local ioctls on the affected object.