PatchSiren cyber security CVE debrief
CVE-2026-31767 Linux CVE debrief
CVE-2026-31767 is a Linux kernel DRM/i915 issue in DSI command mode where DSC-related horizontal timing adjustments could shrink timing values enough to trigger a division-by-zero while calculating vtotal. NVD rates it CVSS 5.5 (MEDIUM) with a local, low-privilege availability impact. The fix stops applying those horizontal timing adjustments in command mode and is referenced by multiple stable kernel patch links.
- Vendor
- Linux
- Product
- CVE-2026-31767
- CVSS
- MEDIUM 5.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-01
- Original CVE updated
- 2026-05-11
- Advisory published
- 2026-05-01
- Advisory updated
- 2026-05-11
Who should care
Linux distribution maintainers, kernel backport teams, OEMs shipping affected Intel graphics/i915 stacks, and administrators of systems that use the affected Linux kernel branches or DSI/DSC display paths.
Technical summary
The kernel change addresses a bug in drm/i915/dsi: in command mode, horizontal timing values were being adjusted based on compression ratio even though the fix description says that behavior should apply only in video mode. On some systems the adjusted htotal became so small that line_time_us evaluated to 0 during vtotal calculation, causing a division-by-zero and kernel crash when the driver loaded. NVD maps the issue to Linux kernel ranges including 5.6 through before 6.12.81, 6.13 through before 6.18.22, 6.19 through before 6.19.12, and 7.0 release candidates rc1 through rc6.
Defensive priority
Medium
Recommended defensive actions
- Apply the linked stable kernel patches or vendor kernel updates for all affected Linux kernel branches.
- Prioritize patching systems that use the i915 DRM driver and DSI display paths, especially where command mode panels are in use.
- Verify fleet kernel versions against the NVD vulnerable version ranges and backport the fix where a full kernel upgrade is not immediately possible.
Evidence notes
This debrief is based on the NVD CVE record, its listed affected-version criteria, the CVSS vector, and the linked stable kernel patch references. The kernel description explicitly states the command-mode timing adjustment change and the resulting division-by-zero condition. No exploit code or reproduction guidance is included.
Official resources
-
CVE-2026-31767 CVE record
CVE.org
-
CVE-2026-31767 NVD detail
NVD
-
Source item URL
nvd_modified
-
Mitigation or vendor reference
416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch
-
Mitigation or vendor reference
416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch
-
Mitigation or vendor reference
416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch
-
Mitigation or vendor reference
416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch
Published by NVD on 2026-05-01 and last modified on 2026-05-11. This debrief uses the published CVE data and linked official patch references only.