Bug 2495950 (CVE-2026-53356)

Summary:	CVE-2026-53356 kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's `drm/i915/gem` component. This vulnerability occurs because the `sg_page()` function incorrectly scales `pread/pwrite` operations for physical Buffer Objects (BO) when a non-zero offset is used. This can lead to incorrect memory access, potentially allowing an attacker to read or write to unintended memory regions. Such access could result in information disclosure or data corruption.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-01 14:03:09 UTC

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/gem: Fix phys BO pread/pwrite with offset

sg_page() returns struct page pointer not (void *) so the scaling
of pread/pwrite is wrong for phys BO and wrong parts of BO would be
accessed if non-zero offset is used.

Last impacted platform with overlay or cursor planes using phys
mapping was Gen3/945G/Lakeport.

(cherry picked from commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6)

Comment 1 Mauro Matteo Cascella 2026-07-01 16:42:07 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026070147-CVE-2026-53356-0d5f@gregkh/T