ZeroDay Findings
Sign inSign up

Findings

CVE-2026-53356

drm/i915/gem: Fix phys BO pread/pwrite with offset

Published Jul 1, 2026 · updated Oct 15, 2026 · Linux Linux

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread/pwrite with offset sg_page() returns struct page pointer not (void *) so the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO would be accessed if non-zero offset is used. Last impacted platform with overlay or cursor planes using phys mapping was Gen3/945G/Lakeport. (cherry picked from commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6)

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 1, 2026 · NIST NVD

    Detected

    In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread/pwrite with offset sg_page() returns struct page pointer not (void *) so the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO would be accessed if non-zero offset is used. Last impacted platform with overlay or cursor planes using phys mapping was Gen3/945G/Lakeport. (cherry picked

  2. Oct 15, 2026 · NIST NVD

    Updated

    In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread/pwrite with offset sg_page() returns struct page pointer not (void *) so the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO would be accessed if non-zero offset is used. Last impacted platform with overlay or cursor planes using phys mapping was Gen3/945G/Lakeport. (cherry picked

Affected

  • cpe linux/linux kernelversion unspecified
  • cpe linux/linux kernel7.1
  • vendor Linux Linuxversion unspecified

Sources

  • CIRCL Vulnerability LookupVulnerability recordCVE-2026-53356

    In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread/pwrite with offset sg_page() returns struct page pointer not (void *) so the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO would be accessed if non-zero offset

    vulnerability.circl.lu
  • CVE.orgVulnerability recordCVE-2026-53356

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-53356

    30-day exploitation probability 0.1%

    first.org
  • NIST NVDVulnerability recordCVE-2026-53356

    In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread/pwrite with offset sg_page() returns struct page pointer not (void *) so the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO would be accessed if non-zero offs

    nvd.nist.gov

References