CVE-2026-43368

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/i915: Fix potential overflow of shmem scatterlist length

When a scatterlists table of a GEM shmem object of size 4 GB or more is

populated with pages allocated from a folio, unsigned int .length

attribute of a scatterlist may get overflowed if total byte length of

pages allocated to that single scatterlist happens to reach or cross the

4GB limit. As a consequence, users of the object may suffer from hitting

unexpected, premature end of the object's backing pages.

[278.780187] ------------[ cut here ]------------

[278.780377] WARNING: CPU: 1 PID: 2326 at drivers/gpu/drm/i915/i915_mm.c:55 remap_sg+0x199/0x1d0 [i915]

...

[278.780654] CPU: 1 UID: 0 PID: 2326 Comm: gem_mmap_offset Tainted: G S U 6.17.0-rc1-CI_DRM_16981-ged823aaa0607+ #1 PREEMPT(voluntary)

[278.780656] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER

[278.780658] Hardware name: Intel Corporation Meteor Lake Client Platform/MTL-P LP5x T3 RVP, BIO

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References