In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for… (CVE-2026-99006)

The Linux kernel's drm/i915/gem subsystem contained a vulnerability where the function eb_relocate_parse_slow() could free memory entries outside the bounds of the original exec array. This was due to eb_copy_relocations() allocating copies based on eb->buffer_count, which is incremented by eb_parse() when appending VMAs. Cleanup code then incorrectly used the incremented buffer_count to free relocation pointers, potentially leading to out-of-bounds memory operations. The fix ensures that cleanup uses the original exec object count, preventing overstepping the exec array boundary.

The vulnerability could lead to improper memory management in the drm/i915/gem component of the Linux kernel, potentially causing memory corruption or instability. No specific exploitation details or active exploits are reported.

A fix has been applied to the Linux kernel to correct the relocation cleanup logic. Users should update to a Linux kernel version that includes the commit 2a0158925fb943c7ba8f3216e2734952128defc9 or later to remediate this issue.