PatchSiren cyber security CVE debrief
CVE-2026-31767 Linux CVE debrief
CVE-2026-31767 is a Linux kernel DRM/i915 issue in DSI command mode where DSC-related horizontal timing adjustments could shrink timing values enough to trigger a division-by-zero while calculating vtotal. NVD rates it CVSS 5.5 (MEDIUM) with a local, low-privilege availability impact. The fix stops applying those horizontal timing adjustments in command mode and is referenced by multiple stable kernel patch links.
- Vendor
- Linux
- Product
- Unknown
- CVSS
- MEDIUM 5.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-01
- Original CVE updated
- 2026-05-11
- Advisory published
- 2026-05-01
- Advisory updated
- 2026-05-11
Who should care
Linux distribution maintainers, kernel backport teams, OEMs shipping affected Intel graphics/i915 stacks, and administrators of systems that use the affected Linux kernel branches or DSI/DSC display paths.
Technical summary
The kernel change addresses a bug in drm/i915/dsi: in command mode, horizontal timing values were being adjusted based on compression ratio even though the fix description says that behavior should apply only in video mode. On some systems the adjusted htotal became so small that line_time_us evaluated to 0 during vtotal calculation, causing a division-by-zero and kernel crash when the driver loaded. NVD maps the issue to Linux kernel ranges including 5.6 through before 6.12.81, 6.13 through before 6.18.22, 6.19 through before 6.19.12, and 7.0 release candidates rc1 through rc6.
Defensive priority
Medium
Recommended defensive actions
- Apply the linked stable kernel patches or vendor kernel updates for all affected Linux kernel branches.
- Prioritize patching systems that use the i915 DRM driver and DSI display paths, especially where command mode panels are in use.
- Verify fleet kernel versions against the NVD vulnerable version ranges and backport the fix where a full kernel upgrade is not immediately possible.
Evidence notes
This debrief is based on the NVD CVE record, its listed affected-version criteria, the CVSS vector, and the linked stable kernel patch references. The kernel description explicitly states the command-mode timing adjustment change and the resulting division-by-zero condition. No exploit code or reproduction guidance is included.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-31767 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-31767
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-31767 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-31767
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://git.kernel.org/stable/c/33b5336e4fd8ba0e40a12989cadb3f5534a0f9e4
416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://git.kernel.org/stable/c/4dfce79e098915d8e5fc2b9e1d980bc3251dd32c
416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://git.kernel.org/stable/c/55efe8402f46af8399c8b634a18b130a05fd7820
416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://git.kernel.org/stable/c/86e926b108880c0109b8635e459450447156aeb7
416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.