CVE-2026-23467

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/dmc: Fix an unlikely NULL pointer deference at probe

intel_dmc_update_dc6_allowed_count() oopses when DMC hasn't been

initialized, and dmc is thus NULL.

That would be the case when the call path is

intel_power_domains_init_hw() -> {skl,bxt,icl}_display_core_init() ->

gen9_set_dc_state() -> intel_dmc_update_dc6_allowed_count(), as

intel_power_domains_init_hw() is called *before* intel_dmc_init().

However, gen9_set_dc_state() calls intel_dmc_update_dc6_allowed_count()

conditionally, depending on the current and target DC states. At probe,

the target is disabled, but if DC6 is enabled, the function is called,

and an oops follows. Apparently it's quite unlikely that DC6 is enabled

at probe, as we haven't seen this failure mode before.

It is also strange to have DC6 enabled at boot, since that would require

the DMC firmware (loaded by BIOS); the BIOS loading the DMC firmware and

the driver stopping / reprogram

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References