In the Linux kernel the DMC firmware driver incorrectly converts the firmware size from dwords to bytes without proper overflow checking, and accepts zero‑length payloads or zero MMIO counts in the firmware header. The result is that a malformed firmware image can cause an out‑of‑bounds write or other memory corruption during parsing, potentially allowing a local attacker to execute code with elevated privileges. The vulnerability is a classic integer overflow and improper input validation flaw that was remedied by validating the size conversion with check_mul_overflow(), rejecting malformed headers, and deferring the firmware size calculation until after allocation succeeds. The fix was introduced by cherry‑picking commit efde6601a1f1daedfe3dcc2816c934ddb44e3eef.

The vulnerability affects all supported Linux kernel releases prior to the inclusion of the patch commit. The affected component is the i915 display driver’s Dynamic Memory Control (DMC) firmware loader. No specific kernel version range is listed, so any kernel that has not incorporated this fix should be considered vulnerable.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known public exploits as of this assessment. However, because the issue occurs in privileged kernel code, successful exploitation would allow an attacker with ability to supply firmware—either through local hardware access or during device initialization—to corrupt memory and potentially gain root or bypass security mechanisms. The lack of a documented public exploit does not diminish the seriousness of a kernel integer overflow flaw, which can be leveraged to achieve privilege escalation. The intended attack vector is inferred to be local or hardware‑based, as malicious firmware could be injected during device startup or through a vendor‑provided firmware update path.