GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-43368 (GCVE-0-2026-43368)

Vulnerability from cvelistv5 – Published: 2026-05-08 14:21 – Updated: 2026-08-05 12:27
VLAI
Title
drm/i915: Fix potential overflow of shmem scatterlist length
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential overflow of shmem scatterlist length When a scatterlists table of a GEM shmem object of size 4 GB or more is populated with pages allocated from a folio, unsigned int .length attribute of a scatterlist may get overflowed if total byte length of pages allocated to that single scatterlist happens to reach or cross the 4GB limit. As a consequence, users of the object may suffer from hitting unexpected, premature end of the object's backing pages. [278.780187] ------------[ cut here ]------------ [278.780377] WARNING: CPU: 1 PID: 2326 at drivers/gpu/drm/i915/i915_mm.c:55 remap_sg+0x199/0x1d0 [i915] ... [278.780654] CPU: 1 UID: 0 PID: 2326 Comm: gem_mmap_offset Tainted: G S U 6.17.0-rc1-CI_DRM_16981-ged823aaa0607+ #1 PREEMPT(voluntary) [278.780656] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER [278.780658] Hardware name: Intel Corporation Meteor Lake Client Platform/MTL-P LP5x T3 RVP, BIOS MTLPFWI1.R00.3471.D91.2401310918 01/31/2024 [278.780659] RIP: 0010:remap_sg+0x199/0x1d0 [i915] ... [278.780786] Call Trace: [278.780787] <TASK> [278.780788] ? __apply_to_page_range+0x3e6/0x910 [278.780795] ? __pfx_remap_sg+0x10/0x10 [i915] [278.780906] apply_to_page_range+0x14/0x30 [278.780908] remap_io_sg+0x14d/0x260 [i915] [278.781013] vm_fault_cpu+0xd2/0x330 [i915] [278.781137] __do_fault+0x3a/0x1b0 [278.781140] do_fault+0x322/0x640 [278.781143] __handle_mm_fault+0x938/0xfd0 [278.781150] handle_mm_fault+0x12c/0x300 [278.781152] ? lock_mm_and_find_vma+0x4b/0x760 [278.781155] do_user_addr_fault+0x2d6/0x8e0 [278.781160] exc_page_fault+0x96/0x2c0 [278.781165] asm_exc_page_fault+0x27/0x30 ... That issue was apprehended by the author of a change that introduced it, and potential risk even annotated with a comment, but then never addressed. When adding folio pages to a scatterlist table, take care of byte length of any single scatterlist not exceeding max_segment. (cherry picked from commit 06249b4e691a75694c014a61708c007fb5755f60)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0b62af28f249b9c4036a05acfb053058dc02e2e2 , < aeb7255531ba4a5c3a64938577170d08b78de399 (git)
Affected: 0b62af28f249b9c4036a05acfb053058dc02e2e2 , < 1c956f0fccc26fefcbb507516c49d1db41c40471 (git)
Affected: 0b62af28f249b9c4036a05acfb053058dc02e2e2 , < eae4bf4107571283031db96ce132e951615e2ae4 (git)
Affected: 0b62af28f249b9c4036a05acfb053058dc02e2e2 , < 21a301f12d18797bf889c15497f922edfdaece3a (git)
Affected: 0b62af28f249b9c4036a05acfb053058dc02e2e2 , < 029ae067431ab9d0fca479bdabe780fa436706ea (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.6.130 , ≤ 6.6.* (semver)
Unaffected: 6.12.78 , ≤ 6.12.* (semver)
Unaffected: 6.18.19 , ≤ 6.18.* (semver)
Unaffected: 6.19.9 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/gem/i915_gem_shmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aeb7255531ba4a5c3a64938577170d08b78de399",
              "status": "affected",
              "version": "0b62af28f249b9c4036a05acfb053058dc02e2e2",
              "versionType": "git"
            },
            {
              "lessThan": "1c956f0fccc26fefcbb507516c49d1db41c40471",
              "status": "affected",
              "version": "0b62af28f249b9c4036a05acfb053058dc02e2e2",
              "versionType": "git"
            },
            {
              "lessThan": "eae4bf4107571283031db96ce132e951615e2ae4",
              "status": "affected",
              "version": "0b62af28f249b9c4036a05acfb053058dc02e2e2",
              "versionType": "git"
            },
            {
              "lessThan": "21a301f12d18797bf889c15497f922edfdaece3a",
              "status": "affected",
              "version": "0b62af28f249b9c4036a05acfb053058dc02e2e2",
              "versionType": "git"
            },
            {
              "lessThan": "029ae067431ab9d0fca479bdabe780fa436706ea",
              "status": "affected",
              "version": "0b62af28f249b9c4036a05acfb053058dc02e2e2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/gem/i915_gem_shmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.19",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: Fix potential overflow of shmem scatterlist length\n\nWhen a scatterlists table of a GEM shmem object of size 4 GB or more is\npopulated with pages allocated from a folio, unsigned int .length\nattribute of a scatterlist may get overflowed if total byte length of\npages allocated to that single scatterlist happens to reach or cross the\n4GB limit.  As a consequence, users of the object may suffer from hitting\nunexpected, premature end of the object\u0027s backing pages.\n\n[278.780187] ------------[ cut here ]------------\n[278.780377] WARNING: CPU: 1 PID: 2326 at drivers/gpu/drm/i915/i915_mm.c:55 remap_sg+0x199/0x1d0 [i915]\n...\n[278.780654] CPU: 1 UID: 0 PID: 2326 Comm: gem_mmap_offset Tainted: G S   U              6.17.0-rc1-CI_DRM_16981-ged823aaa0607+ #1 PREEMPT(voluntary)\n[278.780656] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER\n[278.780658] Hardware name: Intel Corporation Meteor Lake Client Platform/MTL-P LP5x T3 RVP, BIOS MTLPFWI1.R00.3471.D91.2401310918 01/31/2024\n[278.780659] RIP: 0010:remap_sg+0x199/0x1d0 [i915]\n...\n[278.780786] Call Trace:\n[278.780787]  \u003cTASK\u003e\n[278.780788]  ? __apply_to_page_range+0x3e6/0x910\n[278.780795]  ? __pfx_remap_sg+0x10/0x10 [i915]\n[278.780906]  apply_to_page_range+0x14/0x30\n[278.780908]  remap_io_sg+0x14d/0x260 [i915]\n[278.781013]  vm_fault_cpu+0xd2/0x330 [i915]\n[278.781137]  __do_fault+0x3a/0x1b0\n[278.781140]  do_fault+0x322/0x640\n[278.781143]  __handle_mm_fault+0x938/0xfd0\n[278.781150]  handle_mm_fault+0x12c/0x300\n[278.781152]  ? lock_mm_and_find_vma+0x4b/0x760\n[278.781155]  do_user_addr_fault+0x2d6/0x8e0\n[278.781160]  exc_page_fault+0x96/0x2c0\n[278.781165]  asm_exc_page_fault+0x27/0x30\n...\n\nThat issue was apprehended by the author of a change that introduced it,\nand potential risk even annotated with a comment, but then never addressed.\n\nWhen adding folio pages to a scatterlist table, take care of byte length\nof any single scatterlist not exceeding max_segment.\n\n(cherry picked from commit 06249b4e691a75694c014a61708c007fb5755f60)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable i915 GEM shmem path is reached through local DRM ioctls and mmap faults on an i915 render device, not via network or adjacent protocols.\nAC:L - An attacker can create a large GEM object and fault/bind it through normal i915 paths; there is no race or victim-controlled timing requirement, and uncertainty about allocator state is scored toward the higher-severity low-complexity value.\nPR:L - The relevant GEM create and mmap ioctls are marked DRM_RENDER_ALLOW and are reachable by a local user with render-node access, without CAP_SYS_ADMIN or DRM master privileges.\nUI:N - No victim action is required after the attacker has local access to the DRM device; the attacker triggers object creation, page population, and mmap/GPU use directly.\nS:U - The impact remains within the kernel/i915 security authority and does not cross a VM, IOMMU, or separate administrative boundary by itself.\nC:H - The overflow corrupts scatterlist length metadata for a user-controlled large object, and later i915 CPU/GPU mapping paths can consume the truncated table and potentially walk/use attacker-groomable scatterlist metadata. Under the required uncertainty rule, this is treated as a high-impact kernel/GPU memory disclosure primitive.\nI:H - The malformed scatterlist can feed GPU page-table or remapping paths with incorrect DMA addresses, plausibly allowing writes through GPU mappings to unintended memory. Under the required uncertainty rule, this is treated as high integrity impact.\nA:H - At minimum the bug can cause premature scatterlist termination leading to kernel warnings/errors, BUG/OOPS-class failures, GPU faults, hangs, or very large unreleased backing-page leaks when triggered repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:27:31.468Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aeb7255531ba4a5c3a64938577170d08b78de399"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c956f0fccc26fefcbb507516c49d1db41c40471"
        },
        {
          "url": "https://git.kernel.org/stable/c/eae4bf4107571283031db96ce132e951615e2ae4"
        },
        {
          "url": "https://git.kernel.org/stable/c/21a301f12d18797bf889c15497f922edfdaece3a"
        },
        {
          "url": "https://git.kernel.org/stable/c/029ae067431ab9d0fca479bdabe780fa436706ea"
        }
      ],
      "title": "drm/i915: Fix potential overflow of shmem scatterlist length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43368",
    "datePublished": "2026-05-08T14:21:20.500Z",
    "dateReserved": "2026-05-01T14:12:56.005Z",
    "dateUpdated": "2026-08-05T12:27:31.468Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43368",
      "date": "2026-09-16",
      "epss": "0.00129",
      "percentile": "0.0292"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43368\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-08T15:16:47.840\",\"lastModified\":\"2026-06-17T10:49:28.053\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/i915: Fix potential overflow of shmem scatterlist length\\n\\nWhen a scatterlists table of a GEM shmem object of size 4 GB or more is\\npopulated with pages allocated from a folio, unsigned int .length\\nattribute of a scatterlist may get overflowed if total byte length of\\npages allocated to that single scatterlist happens to reach or cross the\\n4GB limit.  As a consequence, users of the object may suffer from hitting\\nunexpected, premature end of the object\u0027s backing pages.\\n\\n[278.780187] ------------[ cut here ]------------\\n[278.780377] WARNING: CPU: 1 PID: 2326 at drivers/gpu/drm/i915/i915_mm.c:55 remap_sg+0x199/0x1d0 [i915]\\n...\\n[278.780654] CPU: 1 UID: 0 PID: 2326 Comm: gem_mmap_offset Tainted: G S   U              6.17.0-rc1-CI_DRM_16981-ged823aaa0607+ #1 PREEMPT(voluntary)\\n[278.780656] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER\\n[278.780658] Hardware name: Intel Corporation Meteor Lake Client Platform/MTL-P LP5x T3 RVP, BIOS MTLPFWI1.R00.3471.D91.2401310918 01/31/2024\\n[278.780659] RIP: 0010:remap_sg+0x199/0x1d0 [i915]\\n...\\n[278.780786] Call Trace:\\n[278.780787]  \u003cTASK\u003e\\n[278.780788]  ? __apply_to_page_range+0x3e6/0x910\\n[278.780795]  ? __pfx_remap_sg+0x10/0x10 [i915]\\n[278.780906]  apply_to_page_range+0x14/0x30\\n[278.780908]  remap_io_sg+0x14d/0x260 [i915]\\n[278.781013]  vm_fault_cpu+0xd2/0x330 [i915]\\n[278.781137]  __do_fault+0x3a/0x1b0\\n[278.781140]  do_fault+0x322/0x640\\n[278.781143]  __handle_mm_fault+0x938/0xfd0\\n[278.781150]  handle_mm_fault+0x12c/0x300\\n[278.781152]  ? lock_mm_and_find_vma+0x4b/0x760\\n[278.781155]  do_user_addr_fault+0x2d6/0x8e0\\n[278.781160]  exc_page_fault+0x96/0x2c0\\n[278.781165]  asm_exc_page_fault+0x27/0x30\\n...\\n\\nThat issue was apprehended by the author of a change that introduced it,\\nand potential risk even annotated with a comment, but then never addressed.\\n\\nWhen adding folio pages to a scatterlist table, take care of byte length\\nof any single scatterlist not exceeding max_segment.\\n\\n(cherry picked from commit 06249b4e691a75694c014a61708c007fb5755f60)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/i915/gem/i915_gem_shmem.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0b62af28f249b9c4036a05acfb053058dc02e2e2\",\"lessThan\":\"aeb7255531ba4a5c3a64938577170d08b78de399\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0b62af28f249b9c4036a05acfb053058dc02e2e2\",\"lessThan\":\"1c956f0fccc26fefcbb507516c49d1db41c40471\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0b62af28f249b9c4036a05acfb053058dc02e2e2\",\"lessThan\":\"eae4bf4107571283031db96ce132e951615e2ae4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0b62af28f249b9c4036a05acfb053058dc02e2e2\",\"lessThan\":\"21a301f12d18797bf889c15497f922edfdaece3a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0b62af28f249b9c4036a05acfb053058dc02e2e2\",\"lessThan\":\"029ae067431ab9d0fca479bdabe780fa436706ea\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/i915/gem/i915_gem_shmem.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.130\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.78\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.19\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.9\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5\",\"versionEndExcluding\":\"6.6.130\",\"matchCriteriaId\":\"424B60E1-5C36-40FF-9029-5E50093BEDA5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.78\",\"matchCriteriaId\":\"28D591F5-B196-4CC9-905C-DC80F116E7A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.19\",\"matchCriteriaId\":\"D394AC60-6F28-435F-872A-CCDF384B8331\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.9\",\"matchCriteriaId\":\"E825E7C3-FEAC-4FD3-8A81-78D7387948C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/029ae067431ab9d0fca479bdabe780fa436706ea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1c956f0fccc26fefcbb507516c49d1db41c40471\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/21a301f12d18797bf889c15497f922edfdaece3a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aeb7255531ba4a5c3a64938577170d08b78de399\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/eae4bf4107571283031db96ce132e951615e2ae4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-15T11:39:03+00:00",
      "cve": "CVE-2026-43368",
      "id": "CVE-2026-43368",
      "initial_release_date": "2026-05-08T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/i915: Fix potential overflow of shmem scatterlist length",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43368.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T17:05:06Z",
      "cve": "CVE-2026-43368",
      "id": "CVE-2026-43368",
      "initial_release_date": "2026-05-13T03:34:48Z",
      "product_status:first_fixed": "2",
      "product_status:known_not_affected": "385",
      "product_status:recommended": "145",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43368",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43368.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.