PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-23467 Linux CVE debrief

A NULL pointer dereference vulnerability exists in the Linux kernel's Intel i915 graphics driver, specifically within the Display Micro-Controller (DMC) subsystem. The flaw occurs in `intel_dmc_update_dc6_allowed_count()` when called before DMC initialization completes, causing a kernel oops. The vulnerable code path is triggered during probe when `intel_power_domains_init_hw()` executes prior to `intel_dmc_init()`, and DC6 is unexpectedly enabled in hardware state—likely due to BIOS leaving an unintentional configuration rather than intentional firmware loading. The fix switches from hardware DC6 state tracking to software state tracking, eliminating both the NULL dereference and the incorrect state dependency. Affected versions include Linux kernel 6.16 through 6.18.19, 6.19 through 6.19.9, and 7.0 release candidates 1-4. Local attackers with low privileges can trigger denial of service through this vulnerability.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-03
Original CVE updated
2026-07-24
Advisory published
2026-04-03
Advisory updated
2026-07-24

Who should care

Linux system administrators managing Intel graphics-equipped workstations and servers; kernel maintainers for distributions shipping affected kernel versions; security teams monitoring local privilege escalation and denial-of-service vectors in graphics subsystems

Technical summary

The vulnerability stems from incorrect hardware state tracking in Intel's i915 display driver. The function `intel_dmc_update_dc6_allowed_count()` dereferences a NULL `dmc` pointer when called during early probe, before `intel_dmc_init()` completes initialization. The call chain: `intel_power_domains_init_hw()` → `{skl,bxt,icl}_display_core_init()` → `gen9_set_dc_state()` → `intel_dmc_update_dc6_allowed_count()`. The condition for calling this function depends on DC6 state comparison; when target is disabled but DC6 is enabled in hardware, the NULL dereference occurs. The root cause fix changes from hardware DC6 state (`HW`) to software DC6 state (`SW`) for counter tracking, which is architecturally correct since the counter stop operation requires DC5 counter values captured at counter start time.

Defensive priority

medium

Recommended defensive actions

  • Apply stable kernel patches from kernel.org for affected versions (6.16-6.18.19, 6.19-6.19.9, 7.0-rc1 through rc4)
  • Upgrade to Linux kernel 6.18.20, 6.19.10, or later stable releases where this fix is integrated
  • Monitor system logs for i915 driver oops messages during boot probe sequence on Intel graphics systems
  • Verify DC6 power state handling in BIOS/firmware configurations to prevent unintended hardware state enabling

Evidence notes

CVE description confirms NULL pointer dereference in drm/i915/dmc at probe time. CPE criteria specify affected kernel versions: 6.16-6.18.19, 6.19-6.19.9, and 7.0-rc1 through rc4. CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H yields score 5.5 (MEDIUM). CWE-476 (NULL Pointer Dereference) assigned by NVD. Three kernel.org stable patches provided as fixes.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-23467 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-23467

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-23467 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-23467

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0b35d11fbbcfd1079c8489282a341944228835e3

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/631317825d44283abfe7a8374f13a76ce2032bb8

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ac57eb3b7d2ad649025b5a0fa207315f755ac4f6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.