LiveActive security incident?Get immediate response
CVE Record

CVE-2024-26721: drm/i915/dsc: Fix the macro that calculates DSCC_/DSCA_ PPS reg address

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dsc: Fix the macro that calculates DSCC_/DSCA_ PPS reg address Commit bd077259d0a9 ("drm/i915/vdsc: Add function to read any PPS register") defines a new macro to calculate the DSC PPS register addresses with PPS number as an input. This macro correctly calculates the addresses till PPS 11 since the addresses increment by 4. So in that case the following macro works correctly to give correct register address: _MMIO(_DSCA_PPS_0 + (pps) * 4) However after PPS 11, the register address for PPS 12 increments by 12 because of RC Buffer memory allocation in between. Because of this discontinuity in the address space, the macro calculates wrong addresses for PPS 12 - 16 resulting into incorrect DSC PPS parameter value read/writes causing DSC corruption. This fixes it by correcting this macro to add the offset of 12 for PPS >=12. v3: Add correct paranthesis for pps argument (Jani Nikula) (cherry picked from commit 6074be620c31dc2ae11af96a1a5ea95580976fb5)

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel graphics driver defect in Intel i915 Display Stream Compression handling. A bad register-address calculation can make the driver read or write the wrong DSC PPS values, causing display corruption. The source bundle does not provide CVSS, active exploitation evidence, or a remote attack path.

Executive priority

Treat this as a targeted Linux graphics stability issue unless your environment depends on Intel i915 DSC displays. With no CVSS or exploitation evidence in the provided sources, prioritize normal kernel maintenance and faster remediation for affected display fleets.

Technical view

The i915 DSC PPS address macro handled PPS 0-11 correctly but missed a register-space discontinuity after PPS 11. For PPS 12-16 it calculated incorrect DSCA/DSCC PPS MMIO addresses, leading to incorrect PPS parameter reads or writes and DSC corruption. Stable kernel commits correct the offset logic.

Likely exposure

Exposure appears limited to Linux systems using the Intel i915 graphics driver with DSC paths that access PPS 12-16. The affected version data is incomplete in the bundle, listing Linux 6.7, 6.7.6, and 6.8 without clear range semantics.

Exploitation context

No active exploitation is supported by the provided sources. The CVE is not marked KEV. The documented impact is incorrect graphics-register access causing DSC corruption, not privilege escalation, data exposure, or remote code execution.

Researcher notes

The useful research boundary is version mapping and runtime reachability. Confirm exact downstream affected ranges, whether DSC PPS 12-16 paths are reachable on deployed hardware, and whether vendor kernels contain commits ff5999fb03f467e1e7159f0ddb199c787f7512b9 or 962ac2dce56bb3aad1f82a4bbe3ada57a020287c.

Mitigation direction

  • Check your Linux vendor advisory for CVE-2024-26721 backports.
  • Update kernels to builds containing the referenced stable fixes.
  • Prioritize systems using Intel i915 graphics with DSC-enabled displays.
  • Monitor for display corruption reports on affected kernel branches.

Validation and detection

  • Inventory Linux kernel versions and Intel i915 usage.
  • Confirm whether vendor kernel includes the referenced stable commits.
  • Review graphics logs for DSC or i915 display corruption symptoms.
  • Test affected display configurations after kernel updates.
Prepared
Confidence
medium
Sources
4

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-26721 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
3Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxbd077259d0a9c9bf453e7e9751bf41f1996e6585, bd077259d0a9c9bf453e7e9751bf41f1996e6585unaffected
LinuxLinux6.7, 0, 6.7.6, 6.8affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.