PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-23467 Linux CVE debrief

A NULL pointer dereference vulnerability exists in the Linux kernel's Intel i915 graphics driver, specifically within the Display Micro-Controller (DMC) subsystem. The flaw occurs in `intel_dmc_update_dc6_allowed_count()` when called before DMC initialization completes, causing a kernel oops. The vulnerable code path is triggered during probe when `intel_power_domains_init_hw()` executes prior to `intel_dmc_init()`, and DC6 is unexpectedly enabled in hardware state—likely due to BIOS leaving an unintentional configuration rather than intentional firmware loading. The fix switches from hardware DC6 state tracking to software state tracking, eliminating both the NULL dereference and the incorrect state dependency. Affected versions include Linux kernel 6.16 through 6.18.19, 6.19 through 6.19.9, and 7.0 release candidates 1-4. Local attackers with low privileges can trigger denial of service through this vulnerability.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-03
Original CVE updated
2026-05-26
Advisory published
2026-04-03
Advisory updated
2026-05-26

Who should care

Linux system administrators managing Intel graphics-equipped workstations and servers; kernel maintainers for distributions shipping affected kernel versions; security teams monitoring local privilege escalation and denial-of-service vectors in graphics subsystems

Technical summary

The vulnerability stems from incorrect hardware state tracking in Intel's i915 display driver. The function `intel_dmc_update_dc6_allowed_count()` dereferences a NULL `dmc` pointer when called during early probe, before `intel_dmc_init()` completes initialization. The call chain: `intel_power_domains_init_hw()` → `{skl,bxt,icl}_display_core_init()` → `gen9_set_dc_state()` → `intel_dmc_update_dc6_allowed_count()`. The condition for calling this function depends on DC6 state comparison; when target is disabled but DC6 is enabled in hardware, the NULL dereference occurs. The root cause fix changes from hardware DC6 state (`HW`) to software DC6 state (`SW`) for counter tracking, which is architecturally correct since the counter stop operation requires DC5 counter values captured at counter start time.

Defensive priority

medium

Recommended defensive actions

  • Apply stable kernel patches from kernel.org for affected versions (6.16-6.18.19, 6.19-6.19.9, 7.0-rc1 through rc4)
  • Upgrade to Linux kernel 6.18.20, 6.19.10, or later stable releases where this fix is integrated
  • Monitor system logs for i915 driver oops messages during boot probe sequence on Intel graphics systems
  • Verify DC6 power state handling in BIOS/firmware configurations to prevent unintended hardware state enabling

Evidence notes

CVE description confirms NULL pointer dereference in drm/i915/dmc at probe time. CPE criteria specify affected kernel versions: 6.16-6.18.19, 6.19-6.19.9, and 7.0-rc1 through rc4. CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H yields score 5.5 (MEDIUM). CWE-476 (NULL Pointer Dereference) assigned by NVD. Three kernel.org stable patches provided as fixes.

Official resources

2026-04-03