CVE-2026-23467 - Vulnerability Details

- drm/i915/dmc: Fix an unlikely NULL pointer deference at probe

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/dmc: Fix an unlikely NULL pointer deference at probe

intel_dmc_update_dc6_allowed_count() oopses when DMC hasn't been
initialized, and dmc is thus NULL.

That would be the case when the call path is
intel_power_domains_init_hw() -> {skl,bxt,icl}_display_core_init() ->
gen9_set_dc_state() -> intel_dmc_update_dc6_allowed_count(), as
intel_power_domains_init_hw() is called *before* intel_dmc_init().

However, gen9_set_dc_state() calls intel_dmc_update_dc6_allowed_count()
conditionally, depending on the current and target DC states. At probe,
the target is disabled, but if DC6 is enabled, the function is called,
and an oops follows. Apparently it's quite unlikely that DC6 is enabled
at probe, as we haven't seen this failure mode before.

It is also strange to have DC6 enabled at boot, since that would require
the DMC firmware (loaded by BIOS); the BIOS loading the DMC firmware and
the driver stopping / reprogramming the firmware is a poorly specified
sequence and as such unlikely an intentional BIOS behaviour. It's more
likely that BIOS is leaving an unintentionally enabled DC6 HW state
behind (without actually loading the required DMC firmware for this).

The tracking of the DC6 allowed counter only works if starting /
stopping the counter depends on the _SW_ DC6 state vs. the current _HW_
DC6 state (since stopping the counter requires the DC5 counter captured
when the counter was started). Thus, using the HW DC6 state is incorrect
and it also leads to the above oops. Fix both issues by using the SW DC6
state for the tracking.

This is v2 of the fix originally sent by Jani, updated based on the
first Link: discussion below.

(cherry picked from commit 2344b93af8eb5da5d496b4e0529d35f0f559eaf0)

Published: 2026-04-03

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability originates from a NULL pointer dereference in the Intel DMC update routine during system probe. When the Display Power Management (DC6) state is enabled before the Dynamic Memory Controller is initialized, the routine accesses a NULL pointer and triggers a kernel oops. This results in a system crash and loss of availability for the affected commodity. The weakness is classified as CWE‑476.

Affected Systems

The flaw affects Linux kernel builds that include the i915 graphics driver and support Intel CPUs such as Skylake, Broxton and Ice Lake. Any system that boots with the DMC firmware enabled before the display power domains are initialized is vulnerable. The specific kernel versions prior to the patch are not listed in the data, but kernel updates prior to the inclusion of the fix carry the risk.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity, and the EPSS score is not available, so the likelihood of exploitation is uncertain. Because the fault occurs only when DC6 is enabled at boot—a rare state caused by BIOS or firmware misconfiguration—the attack vector is unlikely and would likely require local or privileged access to the machine. The vulnerability does not enable code execution; it only causes a crash, so it is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`88c1f9a4d36de61f87cc52aac670020b13d1ccaa`	affected	< 0b35d11fbbcfd1079c8489282a341944228835e3
`88c1f9a4d36de61f87cc52aac670020b13d1ccaa`	affected	< 631317825d44283abfe7a8374f13a76ce2032bb8
`88c1f9a4d36de61f87cc52aac670020b13d1ccaa`	affected	< ac57eb3b7d2ad649025b5a0fa207315f755ac4f6

Linux

affected

Version	Status	Constraints
`6.16`	affected	—
`0`	unaffected	< 6.16
`6.18.20`	unaffected	≤ 6.18.*
`6.19.10`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[88c1f9a4d36de61f87cc52aac670020b13d1ccaa,0b35d11fbbcfd1079c8489282a341944228835e3)`	affected	code_commit	—
`[88c1f9a4d36de61f87cc52aac670020b13d1ccaa,631317825d44283abfe7a8374f13a76ce2032bb8)`	affected	code_commit	—
`[88c1f9a4d36de61f87cc52aac670020b13d1ccaa,ac57eb3b7d2ad649025b5a0fa207315f755ac4f6)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.16`	affected	generic	—
`[0,6.16)`	unaffected	generic	—
`[6.18.20,6.19.0]`	unaffected	semver	—
`[6.19.10,6.20.0]`	unaffected	semver	—
`[7.0-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update to a kernel version that contains the i915/dmc NULL pointer dereference fix
If a newer kernel is unavailable, backport the commit that resolves the fault
Verify that the system BIOS loads all required DMC firmware before the driver initializes and update the BIOS if necessary
Consider disabling the DC6 state in BIOS or via kernel parameters if it is not needed
Monitor system logs for any oops events related to the i915 driver and investigate promptly

Generated by OpenCVE AI on April 4, 2026 at 03:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00024.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0b35d11fbbcfd1079c8489282a341944228835e3
https://git.kernel.org/stable/c/631317825d44283abfe7a8374f13a76ce2032bb8
https://git.kernel.org/stable/c/ac57eb3b7d2ad649025b5a0fa207315f755ac4f6
https://lore.kernel.org/linux-cve-announce/2026040321-CVE-2026-23467-9cfe@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23467
https://www.cve.org/CVERecord?id=CVE-2026-23467

History

Sat, 04 Apr 2026 01:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026040321-CVE-2026-23467-9cfe@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23467 https://www.cve.org/CVERecord?id=CVE-2026-23467
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 03 Apr 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Fri, 03 Apr 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Fix an unlikely NULL pointer deference at probe intel_dmc_update_dc6_allowed_count() oopses when DMC hasn't been initialized, and dmc is thus NULL. That would be the case when the call path is intel_power_domains_init_hw() -> {skl,bxt,icl}_display_core_init() -> gen9_set_dc_state() -> intel_dmc_update_dc6_allowed_count(), as intel_power_domains_init_hw() is called before intel_dmc_init(). However, gen9_set_dc_state() calls intel_dmc_update_dc6_allowed_count() conditionally, depending on the current and target DC states. At probe, the target is disabled, but if DC6 is enabled, the function is called, and an oops follows. Apparently it's quite unlikely that DC6 is enabled at probe, as we haven't seen this failure mode before. It is also strange to have DC6 enabled at boot, since that would require the DMC firmware (loaded by BIOS); the BIOS loading the DMC firmware and the driver stopping / reprogramming the firmware is a poorly specified sequence and as such unlikely an intentional BIOS behaviour. It's more likely that BIOS is leaving an unintentionally enabled DC6 HW state behind (without actually loading the required DMC firmware for this). The tracking of the DC6 allowed counter only works if starting / stopping the counter depends on the _SW_ DC6 state vs. the current _HW_ DC6 state (since stopping the counter requires the DC5 counter captured when the counter was started). Thus, using the HW DC6 state is incorrect and it also leads to the above oops. Fix both issues by using the SW DC6 state for the tracking. This is v2 of the fix originally sent by Jani, updated based on the first Link: discussion below. (cherry picked from commit 2344b93af8eb5da5d496b4e0529d35f0f559eaf0)
Title		drm/i915/dmc: Fix an unlikely NULL pointer deference at probe
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0b35d11fbbcfd1079c8489282a341944228835e3 https://git.kernel.org/stable/c/631317825d44283abfe7a8374f13a76ce2032bb8 https://git.kernel.org/stable/c/ac57eb3b7d2ad649025b5a0fa207315f755ac4f6

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-04-03T15:15:46.483Z

Updated: 2026-05-11T22:07:33.221Z

Reserved: 2026-01-13T15:37:46.021Z

Link: CVE-2026-23467

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-04-03T16:16:34.177

Modified: 2026-04-07T13:20:55.200

Link: CVE-2026-23467

Redhat

Severity : Moderate

Publid Date: 2026-04-03T00:00:00Z

Links: CVE-2026-23467 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-07T07:17:11Z

Weaknesses

CWE-476

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object