CVE-2026-68254

drm/i915/vrr: require valid min/max vfreq for VRR

N/A

Published: August 10, 2026 at 12:01 PM UTC

Updated: August 23, 2026 at 01:17 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

N/A

Exploit prediction

EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: drm/i915/vrr: require valid min/max vfreq for VRR Ensure the EDID provided min/max vfreq are valid. Most scenarios are already covered (by coincidence) through the checks in intel_vrr_is_capable() and intel_vrr_is_in_range(), but be more explicit about it. At worst, a zero min_vfreq could lead to a division by zero in intel_vrr_compute_vmax(). Discovered using AI-assisted static analysis confirmed by Intel Product Security. (cherry picked from commit 1765cf59f517b02f3b0591fe5120930d08bddeb6)

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

5.12 ≤ v < 5.15.2175.12 ≤ v < 6.1.1845.12 ≤ v < 6.12.1035.12 ≤ v < 6.18.445.12 ≤ v < 6.6.1515.12 ≤ v < 7.1.65.12 ≤ v < 7.2117cd09ba52857a60dc5d7f61941046625d8ff5a5.12

Vendor states this is fixed in 2f9aa8d42b7fc17621894456433ac07689fb4a21 (fixed)

Vendor states this is fixed in 5225122b9cad6b0c61e767fb2adea8c07da925be (fixed)

Vendor states this is fixed in 6598ac1721c3a5543efdbcab579a8561268d7ce1 (fixed)

Vendor states this is fixed in c726c8bbee5115dad37fa7867136ebaa50690331 (fixed)

Vendor states this is fixed in df1582c0a101e2e2f133dd331d2a3258bb6a7518 (fixed)

Vendor states this is fixed in f16218689b41efcbc491207cd7716477b1223879 (fixed)

Vendor states this is fixed in f8a9262c7a6fc2de9802e14b0228114f0333869e (fixed)

Vendor states this is fixed in 5.12 (unaffected)

Vendor states this is fixed in 5.15.217 (unaffected)

Vendor states this is fixed in 6.1.184 (unaffected)

Vendor states this is fixed in 6.12.103 (unaffected)

Vendor states this is fixed in 6.18.44 (unaffected)