{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-99005 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-99005 is a vulnerability in Linux, published on 23 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-99005 and fix it if it is affected.\n\nWhat it is: CVE-2026-99005 is a vulnerability in Linux, published on 23 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-99005 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-99005/ (Markdown: https://insights.sbomify.com/CVE-2026-99005/index.md)","id":"CVE-2026-99005","markdown":"https://insights.sbomify.com/CVE-2026-99005/index.md","name":"CVE-2026-99005","record":{"aliases":["AZL-110843","BELL-CVE-2026-99005","DEBIAN-CVE-2026-99005","GHSA-vcpf-23w8-q6wv","UBUNTU-CVE-2026-99005"],"analysis":null,"analysis_generated_by":null,"assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Unmask interrupts only when ACTIVE is true\n\nThere is a small race window between intel_rps_boost() reading\na stale ACTIVE state and queuing rps-\u003ework, where ACTIVE may be\nchanged via asynchronous calls triggered by wakeref drop.\nThis means that rps_work() could be triggered after the GT has\nbeen parked, so unmasking RPS PM interrupts would happen without\nholding PM wakelock. This sequence of events may be observed\nduring live_rc6_ctx_wa() selftest:\n\n1) live_rc6_ctx_wa()\n   -\u003e intel_engine_pm_put()\n      -\u003e wakeref_put()\n\nASYNC1) wakeref_put() callback\n          -\u003e __engine_park()\n             -\u003e intel_gt_pm_put_async()\n                -\u003e intel_gt_pm_put_async_untracked()\n                   -\u003e intel_wakeref_put_async()\n\nASYNC2) wakeref_put_async() callback\n          -\u003e __gt_park()\n             -\u003e intel_rps_park()\n                -\u003e intel_rps_clear_active() [clear ACTIVE]\n                WITH INTERRUPTS:\n                -\u003e rps_disable_interrupts()\n                   -\u003e cancel_work_sync(rps-\u003ework)\n                   -\u003e rps_reset_interrupts() [rps-\u003epm_iir = 0]\n                WITHOUT INTERRUPTS (TIMER mode):\n                -\u003e rps_stop_timer()\n                   -\u003e cancel_work_sync(rps-\u003ework)\n\n2) live_rc6_ctx_wa()\n   -\u003e intel_gt_wait_for_idle()\n      -\u003e intel_gt_retire_requests_timeout()\n         -\u003e dma_fence_wait_timeout()\n            -\u003e ops-\u003ewait() [i915_fence_wait()]\n               -\u003e i915_request_wait_timeout()\n                  -\u003e intel_rps_boost()\n                     -\u003e intel_rps_is_active() [check ACTIVE]\n                        [OPEN RACE WINDOW]\n                     -\u003e queue_work(rps-\u003ework)\n         -\u003e retire_requests()\n            -\u003e i915_request_retire()\n               -\u003e intel_rps_dec_waiters() [from 1 to 0]\n\nIf ASYNC1 and ASYNC2 would execute during [OPEN RACE WINDOW],\nthen:\n\n3) rps_work() executes from the workqueue and may satisfy\n   \"(!pm_iir \u0026\u0026 !client_boost)\" test (in TIMER mode rps-\u003epm_iir\n   is zeroed by an earlier rps_work() call or never gets a new\n   value after previous intel_rps_unpark() event), so it jumps\n   to \"out\" label, bypassing intel_rps_is_active() guard and\n   executes gen6_gt_pm_unmask_irq();\n\n4) GT is parked and runtime PM wakelock is dropped, so only\n   a raw reference in __gt_park() -\u003e\n   intel_display_power_put_async() remains for 100ms, then the\n   MMIO write in gen6_gt_pm_unmask_irq() detects missing\n   wakelock via assert_rpm_wakelock_held() and emits\n   \"RPM wakelock ref not held during HW access\" tainting kernel.\n\nCommit 3e7abf814193 (\"drm/i915: Extract GT render power state management\")\ndropped the \"if (rps-\u003einterrupts_enabled)\" guard that\ngen6_pm_rps_work() had around this unmask in i915_irq.c.\nINTEL_RPS_ACTIVE brackets the same window, since it is set in\nintel_rps_unpark() before rps_enable_interrupts() and\nrps_start_timer() and cleared in intel_rps_park() before\nrps_stop_timer() and rps_disable_interrupts().\n\nSkip unmasking when RPS is no longer active (reaching unmask\noperation is independent of INTERRUPT mode). This does not\nprevent RPS operation from resuming on the next unpark.\nIn interrupt mode, intel_rps_unpark() calls\nrps_enable_interrupts(), which enables and unmasks the PM\ninterrupts. In timer mode, it calls rps_start_timer(),\nrestarting periodic engine-busyness evaluation. The timer\ngenerates software RPS events and queues rps_work() directly,\nindependently of PM interrupt delivery. Neither mode requires\nthe late worker to unmask interrupts while the GT is parked\n\n(cherry picked from commit ca4a6deadad15b91ee083afe445fa6bdbfb68206)","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"drm/i915/gt: Unmask interrupts only when ACTIVE is true","id":"CVE-2026-99005","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"drm/i915/gem: Prevent overstepping exec array boundary","id":"CVE-2026-99006"},"packages":[],"prev":{"headline":"drm/imagination: Size page table preallocation by device address","id":"CVE-2026-99004"},"products":["Linux"],"published":"2026-10-23","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-23","vendors":["Linux"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-99005/"}