CVE-2026-97899 drm/i915: Fix memory leak in query_perf_config_list()

Not scored Published 25 Sep 2026 Updated 19 Oct 2026

A memory leak in the i915 graphics driver allows local attackers to exhaust kernel memory, potentially causing a denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-97899?

CVE-2026-97899 is a memory corruption vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

drm/i915: Fix memory leak in query_perf_config_list()

When krealloc() fails, free the original oa_config_ids before returning to avoid a memory leak.

(cherry picked from commit 9977e9d84f46d4f12ad35fbbc0ec4638554bce87)

Which versions are affected by CVE-2026-97899?

How do I fix CVE-2026-97899?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-97899 being exploited?

There is no known exploitation of CVE-2026-97899 in the wild and no public exploit code.

Sources

Also known as AZL-104222, BELL-CVE-2026-97899, DEBIAN-CVE-2026-97899, GHSA-jqpp-x7c4-x6fg, UBUNTU-CVE-2026-97899.