CVE-2026-89822

Low risk· EPSS 10%

Published: 16/09/2026(UTC)Updated: 19/10/2026(UTC)Translated: 16/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

In the Linux kernel, i915_pci_probe() unconditionally casts driver_data to struct intel_device_info * and dereferences intel_info->require_force_probe. When a device is force-bound via sysfs driver_override, pci_match_device() can return the dummy pci_device_id_any entry with unset (NULL) ->driver_data, causing a NULL pointer dereference.

Risk Assessment

This may lead to a kernel panic (denial of service) when force-binding the i915 driver via sysfs.

Recommendation

Update the Linux kernel to a version with the fix that guards against NULL driver_data in i915_pci_probe().

Other vulnerabilities in Linux kernel (drm/i915)

CVE-2026-43368High
In the Linux kernel's drm/i915 component, an overflow occurs in the length field of a scatterlist when populating a scatterlist table for a GEM shmem object of 4 GB or larger. When the total byte length of pages allocated to a single scatterlist reaches or crosses the 4 GB limit, the unsigned int field overflows, causing users to hit an unexpected, premature end of the object's backing pages and triggering warnings in remap_sg.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Guard against NULL driver_data in i915_pci_probe() pci_match_device() can return the dummy pci_device_id_any entry when a device is force-bound via sysfs driver_override, in which case ->driver_data is unset (NULL). i915_pci_probe() casts it to struct intel_device_info * unconditionally and dereferences intel_info->require_force_probe, causing a NULL-ptr-deref. (cherry picked from commit 2727922084672cc274ecea726ea00363c2893731)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS