CVE-2026-68254drm/i915/vrr: require valid min/max vfreq for VRR
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/i915/vrr: require valid min/max vfreq for VRR Ensure the EDID provided min/max vfreq are valid. Most scenarios are already covered (by coincidence) through the checks in intel_vrr_is_capable() and intel_vrr_is_in_range(), but be more explicit about it. At worst, a zero min_vfreq could lead to a division by zero in intel_vrr_compute_vmax(). Discovered using AI-assisted static analysis confirmed by Intel Product Security. (cherry picked from commit 1765cf59f517b02f3b0591fe5120930d08bddeb6)
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 23, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 117cd09ba52857a60dc5d7f61941046625d8ff5a builds before 2f9aa8d42b7fc17621894456433ac07689fb4a21; from 117cd09ba52857a60dc5d7f61941046625d8ff5a before 5225122b9cad6b0c61e767fb2adea8c07da925be; from 117cd09ba52857a60dc5d7f61941046625d8ff5a before 6598ac1721c3a5543efdbcab579a8561268d7ce1; from 117cd09ba52857a60dc5d7f61941046625d8ff5a before f16218689b41efcbc491207cd7716477b1223879; from 117cd09ba52857a60dc5d7f61941046625d8ff5a before df1582c0a101e2e2f133dd331d2a3258bb6a7518; from 117cd09ba52857a60dc5d7f61941046625d8ff5a before c726c8bbee5115dad37fa7867136ebaa50690331; from 117cd09ba52857a60dc5d7f61941046625d8ff5a before f8a9262c7a6fc2de9802e14b0228114f0333869e | CNA record |
References
- https://git.kernel.org/stable/c/2f9aa8d42b7fc17621894456433ac07689fb4a21
- https://git.kernel.org/stable/c/5225122b9cad6b0c61e767fb2adea8c07da925be
- https://git.kernel.org/stable/c/6598ac1721c3a5543efdbcab579a8561268d7ce1
- https://git.kernel.org/stable/c/f16218689b41efcbc491207cd7716477b1223879
- https://git.kernel.org/stable/c/df1582c0a101e2e2f133dd331d2a3258bb6a7518
- https://git.kernel.org/stable/c/c726c8bbee5115dad37fa7867136ebaa50690331
- https://git.kernel.org/stable/c/f8a9262c7a6fc2de9802e14b0228114f0333869e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.