CVE-2026-53356: Linux i915 Kernel Graphics Driver Buffer Offset Memory Access Vulnerability

Technical summary

The vulnerability exists in the i915 DRM driver's handling of physically-backed buffer objects (phys BO). When performing pread/pwrite operations with a non-zero offset, sg_page() returns a struct page pointer rather than a void pointer. The code incorrectly scales the offset value, treating it as if it were already a void pointer, resulting in accessing unintended memory locations. The type confusion causes the offset calculation to be off by a factor of the page structure size, leading to reads or writes at wrong addresses. This is particularly critical for systems using physical memory mapping for graphics planes, a configuration found on older Intel integrated graphics from the Gen3 era through Lakeport.

Business impact

For most modern systems, the practical business impact is limited because physical memory mapping for graphics planes has not been used since the Gen3/Lakeport era of Intel hardware. However, organizations still operating legacy systems with affected Intel integrated graphics may face confidentiality and integrity risks. A local attacker could read kernel memory or corrupt graphics-related kernel structures, potentially leading to privilege escalation or denial of service. The severity escalates in environments where legacy hardware is still in critical use, such as industrial control systems or specialized appliances.

Affected systems

Linux kernel versions containing the vulnerable i915 driver code are affected. The practical impact is restricted to systems with Intel Gen3 integrated graphics (945G/Lakeport era) that use overlay or cursor planes with physical memory mapping. Modern Intel graphics hardware uses different memory management schemes and is not vulnerable. Organizations should inventory systems running affected kernel versions, particularly those with legacy Intel integrated graphics hardware.

Exploitability

The vulnerability requires local code execution privileges to exploit, limiting the threat model to authenticated users or processes on the affected system. It is not remotely exploitable. The bug is triggered when an application calls pread/pwrite on a graphics buffer object with a non-zero offset, and requires understanding of the i915 driver's internal structures. Exploitability is moderate because the preconditions are specific, but local privilege escalation is feasible.

Remediation

Update the Linux kernel to a version containing the fix from commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6 or later. Verify the specific patch version for your distribution and kernel branch. As an interim mitigation, restricting local user access and disabling unnecessary graphics hardware acceleration on legacy systems reduces attack surface. For most organizations with modern hardware, no action is required.

Patch guidance

Patch availability depends on your Linux distribution and kernel branch. Consult your vendor's security advisory and kernel update channels for the specific fixed version. The upstream fix is commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6; verify that your patch includes this cherry-picked commit. Test patches in non-production environments before rollout, especially on systems with legacy graphics hardware where the risk is highest.

Detection guidance

Monitor kernel logs for unusual memory access patterns or graphics driver errors on systems with Gen3/Lakeport Intel graphics. Audit local user and process permissions to identify which accounts have graphics device access. In environments with affected hardware, monitor for unexpected privilege escalation or graphics driver crashes. Kernel Address Sanitizer (KASAN) builds may flag the incorrect offset calculation at runtime. File integrity monitoring on kernel memory regions can detect exploitation attempts.

Why prioritize this

Prioritize patching based on hardware inventory. Systems with modern Intel graphics or non-Intel GPUs require no immediate action. Legacy systems with Gen3/945G/Lakeport hardware should be patched before allowing untrusted local users to access graphics APIs. The CVSS score of 7.8 reflects the high local impact, but the practical risk is proportional to both the presence of vulnerable hardware and the trust model for local access. Organizations should defer this to a scheduled update cycle unless legacy graphics systems are exposed to hostile local users.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects a local attack vector (AV:L), no special configuration required (AC:L), and a requirement for local user privileges (PR:L). The impact is severe: High confidence (C:H), integrity compromise (I:H), and availability impact (A:H) are all achievable through kernel memory manipulation. The score assumes a single impacted user session (S:U). In practice, risk is significantly lower for organizations without Gen3-era hardware, but remains high for those that do and that permit local user access to graphics subsystems.

Frequently asked questions