CVE-2026-99118 drm/i915/dmc: Harden DMC firmware payload parsing

Not scored Published 28 Oct 2026 Updated 28 Oct 2026

Exploited in the wild: Not known
Fix: Available

What is CVE-2026-99118?

CVE-2026-99118 is a vulnerability in Linux, published on 28 Oct 2026.

Official description

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/dmc: Harden DMC firmware payload parsing

Validate the conversion of the DMC firmware size from dwords to bytes using check_mul_overflow() before calculating the firmware payload size.

Reject zero-length payloads and zero MMIO counts in the DMC firmware header so malformed firmware is caught early. Also set dmc_fw_size only after the payload allocation succeeds.

(cherry picked from commit efde6601a1f1daedfe3dcc2816c934ddb44e3eef)

Which versions are affected by CVE-2026-99118?

How do I fix CVE-2026-99118?

Upgrade to a fixed version.

Is CVE-2026-99118 being exploited?

There is no known exploitation of CVE-2026-99118 in the wild and no public exploit code.

Sources

Also known as AZL-111218, BELL-CVE-2026-99118, DEBIAN-CVE-2026-99118, GHSA-v3g3-p6wj-rwgr, UBUNTU-CVE-2026-99118.