CVE-2024-26721: drm/i915/dsc: Fix the macro that calculates DSCC_/DSCA_ PPS reg address
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/dsc: Fix the macro that calculates DSCC_/DSCA_ PPS reg address
Commit bd077259d0a9 ("drm/i915/vdsc: Add function to read any PPS
register") defines a new macro to calculate the DSC PPS register
addresses with PPS number as an input. This macro correctly calculates
the addresses till PPS 11 since the addresses increment by 4. So in that
case the following macro works correctly to give correct register
address:
_MMIO(_DSCA_PPS_0 + (pps) * 4)
However after PPS 11, the register address for PPS 12 increments by 12
because of RC Buffer memory allocation in between. Because of this
discontinuity in the address space, the macro calculates wrong addresses
for PPS 12 - 16 resulting into incorrect DSC PPS parameter value
read/writes causing DSC corruption.
This fixes it by correcting this macro to add the offset of 12 for PPS
>=12.
v3: Add correct paranthesis for pps argument (Jani Nikula)
(cherry picked from commit 6074be620c31dc2ae11af96a1a5ea95580976fb5)
Security readout for executives and security teams
Plain-English summary
This is a Linux kernel graphics driver defect in Intel i915 Display Stream Compression handling. A bad register-address calculation can make the driver read or write the wrong DSC PPS values, causing display corruption. The source bundle does not provide CVSS, active exploitation evidence, or a remote attack path.
Executive priority
Treat this as a targeted Linux graphics stability issue unless your environment depends on Intel i915 DSC displays. With no CVSS or exploitation evidence in the provided sources, prioritize normal kernel maintenance and faster remediation for affected display fleets.
Technical view
The i915 DSC PPS address macro handled PPS 0-11 correctly but missed a register-space discontinuity after PPS 11. For PPS 12-16 it calculated incorrect DSCA/DSCC PPS MMIO addresses, leading to incorrect PPS parameter reads or writes and DSC corruption. Stable kernel commits correct the offset logic.
Likely exposure
Exposure appears limited to Linux systems using the Intel i915 graphics driver with DSC paths that access PPS 12-16. The affected version data is incomplete in the bundle, listing Linux 6.7, 6.7.6, and 6.8 without clear range semantics.
Exploitation context
No active exploitation is supported by the provided sources. The CVE is not marked KEV. The documented impact is incorrect graphics-register access causing DSC corruption, not privilege escalation, data exposure, or remote code execution.
Researcher notes
The useful research boundary is version mapping and runtime reachability. Confirm exact downstream affected ranges, whether DSC PPS 12-16 paths are reachable on deployed hardware, and whether vendor kernels contain commits ff5999fb03f467e1e7159f0ddb199c787f7512b9 or 962ac2dce56bb3aad1f82a4bbe3ada57a020287c.
Mitigation direction
Check your Linux vendor advisory for CVE-2024-26721 backports.
Update kernels to builds containing the referenced stable fixes.
Prioritize systems using Intel i915 graphics with DSC-enabled displays.
Monitor for display corruption reports on affected kernel branches.
Validation and detection
Inventory Linux kernel versions and Intel i915 usage.
Confirm whether vendor kernel includes the referenced stable commits.
Review graphics logs for DSC or i915 display corruption symptoms.
Test affected display configurations after kernel updates.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2024-26721 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.