CVE-2026-89822 PUBLISHED

drm/i915: Guard against NULL driver_data in i915_pci_probe()

Assigner: Linux
Reserved: 11.09.2026 Published: 16.09.2026 Updated: 16.09.2026

In the Linux kernel, the following vulnerability has been resolved:

drm/i915: Guard against NULL driver_data in i915_pci_probe()

pci_match_device() can return the dummy pci_device_id_any entry when a device is force-bound via sysfs driver_override, in which case ->driver_data is unset (NULL). i915_pci_probe() casts it to struct intel_device_info * unconditionally and dereferences intel_info->require_force_probe, causing a NULL-ptr-deref.

(cherry picked from commit 2727922084672cc274ecea726ea00363c2893731)

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to 2239e6b49d33bb38817d69b4f0bf7d5cbde2ec68 (excl.)
  • affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to 4a0236fe97732e31cb4a6dcb433642f9e3ef9a56 (excl.)
  • affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to e351cb2d373f6f1d4f1eb7c9f30dc058c69c89f8 (excl.)
  • affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to 18b3433f10ee9c69e3252046028aa2be421f2d4d (excl.)
  • affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to 84829e324a396668ceafb14723293b2863a74dcf (excl.)
  • affected from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to 3785d40831ba5601296283e0197e10e089392757 (excl.)
  • affected from 0 to 6.1.188 (excl.)
  • affected from 0 to 6.6.157 (excl.)
  • affected from 0 to 6.12.110 (excl.)
  • affected from 0 to 6.18.51 (excl.)
  • affected from 0 to 7.2.5 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • unaffected from 6.1.188 to 6.1.* (incl.)
  • unaffected from 6.6.157 to 6.6.* (incl.)
  • unaffected from 6.12.110 to 6.12.* (incl.)
  • unaffected from 6.18.51 to 6.18.* (incl.)
  • unaffected from 7.2.5 to 7.2.* (incl.)
  • unaffected from 7.3-rc2 to * (incl.)

References