High 7.8Published Jul 1, 2026

CVE-2026-53356drm/i915/gem: Fix phys BO pread/pwrite with offset

Updated under an hour ago (Oct 26, 2026, 4:23 PM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread/pwrite with offset sg_page() returns struct page pointer not (void *) so the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO would be accessed if non-zero offset is used. Last impacted platform with overlay or cursor planes using phys mapping was Gen3/945G/Lakeport. (cherry picked from commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6)

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-1164
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from c6790dc22312f592c1434577258b31c48c72d52a before 40f738991058eb3e3530c3006a5bd6fd5e29f035; from c6790dc22312f592c1434577258b31c48c72d52a before 1ec8fc63e9cdb22da54e48e536c9204020416fc6; from c6790dc22312f592c1434577258b31c48c72d52a before 14469860e2e39b7095dcd658d2bad38a11110a68; from c6790dc22312f592c1434577258b31c48c72d52a before 07c33be968d9e0cab6cba38c81850a09942fcb2e; from c6790dc22312f592c1434577258b31c48c72d52a before 3bd168dd835b93a3862cd05b0d13c432b115f9d6; from c6790dc22312f592c1434577258b31c48c72d52a before 32d4c5d328a3ff995420f4f85163e1e403f43628; from c6790dc22312f592c1434577258b31c48c72d52a before dd51a2eeb93bc6faa892ff9083911dd23f82c187; from c6790dc22312f592c1434577258b31c48c72d52a before d21ad938398bca695a511307de38a65889e3b354	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.7 before 5.10.259; from 5.11 before 5.15.210; from 5.16 before 6.1.176; from 6.2 before 6.6.143; from 6.7 before 6.12.94; from 6.13 before 6.18.36; from 6.19 before 7.0.13; 7.1; and 6 more ranges	NVD

References

References

https://git.kernel.org/stable/c/40f738991058eb3e3530c3006a5bd6fd5e29f035	patch
https://git.kernel.org/stable/c/1ec8fc63e9cdb22da54e48e536c9204020416fc6	patch
https://git.kernel.org/stable/c/14469860e2e39b7095dcd658d2bad38a11110a68	patch
https://git.kernel.org/stable/c/07c33be968d9e0cab6cba38c81850a09942fcb2e	patch
https://git.kernel.org/stable/c/3bd168dd835b93a3862cd05b0d13c432b115f9d6	patch
https://git.kernel.org/stable/c/32d4c5d328a3ff995420f4f85163e1e403f43628	patch
https://git.kernel.org/stable/c/dd51a2eeb93bc6faa892ff9083911dd23f82c187	patch
https://git.kernel.org/stable/c/d21ad938398bca695a511307de38a65889e3b354	patch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.