Not yet scoredPublished Aug 10, 2026

CVE-2026-68254drm/i915/vrr: require valid min/max vfreq for VRR

Updated under an hour ago (Oct 27, 2026, 5:00 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: drm/i915/vrr: require valid min/max vfreq for VRR Ensure the EDID provided min/max vfreq are valid. Most scenarios are already covered (by coincidence) through the checks in intel_vrr_is_capable() and intel_vrr_is_in_range(), but be more explicit about it. At worst, a zero min_vfreq could lead to a division by zero in intel_vrr_compute_vmax(). Discovered using AI-assisted static analysis confirmed by Intel Product Security. (cherry picked from commit 1765cf59f517b02f3b0591fe5120930d08bddeb6)

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 23, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	117cd09ba52857a60dc5d7f61941046625d8ff5a builds before 2f9aa8d42b7fc17621894456433ac07689fb4a21; from 117cd09ba52857a60dc5d7f61941046625d8ff5a before 5225122b9cad6b0c61e767fb2adea8c07da925be; from 117cd09ba52857a60dc5d7f61941046625d8ff5a before 6598ac1721c3a5543efdbcab579a8561268d7ce1; from 117cd09ba52857a60dc5d7f61941046625d8ff5a before f16218689b41efcbc491207cd7716477b1223879; from 117cd09ba52857a60dc5d7f61941046625d8ff5a before df1582c0a101e2e2f133dd331d2a3258bb6a7518; from 117cd09ba52857a60dc5d7f61941046625d8ff5a before c726c8bbee5115dad37fa7867136ebaa50690331; from 117cd09ba52857a60dc5d7f61941046625d8ff5a before f8a9262c7a6fc2de9802e14b0228114f0333869e	CNA record

References

References

https://git.kernel.org/stable/c/2f9aa8d42b7fc17621894456433ac07689fb4a21
https://git.kernel.org/stable/c/5225122b9cad6b0c61e767fb2adea8c07da925be
https://git.kernel.org/stable/c/6598ac1721c3a5543efdbcab579a8561268d7ce1
https://git.kernel.org/stable/c/f16218689b41efcbc491207cd7716477b1223879
https://git.kernel.org/stable/c/df1582c0a101e2e2f133dd331d2a3258bb6a7518
https://git.kernel.org/stable/c/c726c8bbee5115dad37fa7867136ebaa50690331
https://git.kernel.org/stable/c/f8a9262c7a6fc2de9802e14b0228114f0333869e

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.