drm/i915/gem: Fix phys BO pread/pwrite with offset

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread/pwrite with offset sg_page() returns struct page pointer not (void *) so the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO would be accessed if non-zero offset is used. Last impacted platform with overlay or cursor planes using phys mapping was Gen3/945G/Lakeport. (cherry picked from commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6)

Timeline

1. Jul 1, 2026, 1:32 PM UTCCVE published
2. Oct 16, 2026, 3:28 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 19, 2026, 8:07 PM UTCRecord last updated

Affected versions

• Linux Linux

  From c6790dc22312f592c1434577258b31c48c72d52a · fixed in 40f738991058eb3e3530c3006a5bd6fd5e29f035; From c6790dc22312f592c1434577258b31c48c72d52a · fixed in 1ec8fc63e9cdb22da54e48e536c9204020416fc6; From c6790dc22312f592c1434577258b31c48c72d52a · fixed in 14469860e2e39b7095dcd658d2bad38a11110a68; From c6790dc22312f592c1434577258b31c48c72d52a · fixed in 07c33be968d9e0cab6cba38c81850a09942fcb2e; From c6790dc22312f592c1434577258b31c48c72d52a · fixed in 3bd168dd835b93a3862cd05b0d13c432b115f9d6; From c6790dc22312f592c1434577258b31c48c72d52a · fixed in 32d4c5d328a3ff995420f4f85163e1e403f43628; From c6790dc22312f592c1434577258b31c48c72d52a · fixed in dd51a2eeb93bc6faa892ff9083911dd23f82c187; From c6790dc22312f592c1434577258b31c48c72d52a · fixed in d21ad938398bca695a511307de38a65889e3b354

• Linux Linux

  5.7

• KernelLinux

  From 5.7.0 · fixed in 5.10.259; From 5.11.0 · fixed in 5.15.210; From 5.16.0 · fixed in 6.1.176; From 6.2.0 · fixed in 6.6.143; From 6.7.0 · fixed in 6.12.94; From 6.13.0 · fixed in 6.18.36; From 6.19.0 · fixed in 7.0.13

References 8