CVE-2026-53356

HighCVSS 7.8/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/gem: Fix phys BO pread/pwrite with offset

sg_page() returns struct page pointer not (void *) so the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO would be accessed if non-zero offset is used.

Last impacted platform with overlay or cursor planes using phys mapping was Gen3/945G/Lakeport.

(cherry picked from commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6)

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1164

Affected software

VendorProductVersions
LinuxLinux>= c6790dc22312f592c1434577258b31c48c72d52a, < 40f738991058eb3e3530c3006a5bd6fd5e29f035; >= c6790dc22312f592c1434577258b31c48c72d52a, < 1ec8fc63e9cdb22da54e48e536c9204020416fc6; >= c6790dc22312f592c1434577258b31c48c72d52a, < 14469860e2e39b7095dcd658d2bad38a11110a68; >= c6790dc22312f592c1434577258b31c48c72d52a, < 07c33be968d9e0cab6cba38c81850a09942fcb2e; >= c6790dc22312f592c1434577258b31c48c72d52a, < 3bd168dd835b93a3862cd05b0d13c432b115f9d6; >= c6790dc22312f592c1434577258b31c48c72d52a, < 32d4c5d328a3ff995420f4f85163e1e403f43628; >= c6790dc22312f592c1434577258b31c48c72d52a, < dd51a2eeb93bc6faa892ff9083911dd23f82c187; >= c6790dc22312f592c1434577258b31c48c72d52a, < d21ad938398bca695a511307de38a65889e3b354
LinuxLinux5.7
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystem< *

References

Timeline

Published
Jul 1, 2026
Last modified
Oct 19, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-533578.0In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() CVE-2026-533588.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() CVE-2026-533598.8In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role CommCVE-2026-53366.8The DataPress (Dataverse Integration) WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and eCVE-2026-533608.8In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use As per thCVE-2026-533617.1In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reporteCVE-2026-533627.8In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_appendCVE-2026-533639.8In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags() iptfCVE-2026-533645.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate() hci_le_CVE-2026-533655.5In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix zerocopy completion for multi-skb sends When a largeCVE-2026-533667.8In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path In __ip_append_CVE-2026-533675.5In the Linux kernel, the following vulnerability has been resolved: selinux: fix avdcache auditing The per-task avdcache was incorrectly s