Use of Out-of-range Pointer Offset in Linux kernel - CVE-2026-53356
Published: July 2, 2026
Vulnerability identifier: #VU136686
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-53356
CWE-ID: CWE-823
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to disclose or modify unintended memory contents.
The vulnerability exists due to improper pointer handling in i915_gem_object_pread_phys and i915_gem_object_pwrite_phys in the i915 GEM physical buffer object handling code when processing pread or pwrite operations with a non-zero offset. A local user can supply crafted offset values to access the wrong parts of a physical buffer object to disclose or modify unintended memory contents.
The issue affects physical buffer objects on impacted platforms using overlay or cursor planes with physical mapping.
How to mitigate CVE-2026-53356
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/07c33be968d9e0cab6cba38c81850a09942fcb2e
- https://git.kernel.org/stable/c/14469860e2e39b7095dcd658d2bad38a11110a68
- https://git.kernel.org/stable/c/1ec8fc63e9cdb22da54e48e536c9204020416fc6
- https://git.kernel.org/stable/c/32d4c5d328a3ff995420f4f85163e1e403f43628
- https://git.kernel.org/stable/c/3bd168dd835b93a3862cd05b0d13c432b115f9d6
- https://git.kernel.org/stable/c/40f738991058eb3e3530c3006a5bd6fd5e29f035
- https://git.kernel.org/stable/c/d21ad938398bca695a511307de38a65889e3b354
- https://git.kernel.org/stable/c/dd51a2eeb93bc6faa892ff9083911dd23f82c187