CVE-2026-31767: Linux Kernel i915 DSI DoS Vulnerability

CVE-2026-31767 Overview

CVE-2026-31767 is a Linux kernel vulnerability in the Intel i915 Display Serial Interface (DSI) driver. The flaw exists in the Display Stream Compression (DSC) handling logic where horizontal timing values were incorrectly adjusted based on the compression ratio while operating in command mode. This adjustment produces a horizontal total (htotal) so small that line_time_us evaluates to zero, triggering a division-by-zero condition when computing the vertical total in command mode. The issue surfaces during driver load on affected hardware such as the Huawei Matebook E. The upstream fix restricts the timing adjustment to video mode, aligning behavior with the Bspec and the Windows driver.

Critical Impact
A division-by-zero in the i915 DSI driver causes a kernel fault during display driver initialization, preventing the system from booting normally on affected Intel graphics hardware using DSI command mode panels.

Affected Products

Linux kernel containing the drm/i915/dsi driver with DSC command mode support
Systems with Intel integrated graphics driving DSI command mode panels (for example, Huawei Matebook E)
Stable kernel branches prior to the cherry-picked fix from commit 0b475e91ecc2

Discovery Timeline

2026-05-01 - CVE-2026-31767 published to NVD
2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-31767

Vulnerability Analysis

The vulnerability resides in the Intel i915 Direct Rendering Manager (DRM) driver, specifically in the DSI subsystem that handles DSC. When DSC is enabled, the driver scales horizontal timing values by the compression ratio. This scaling was applied in both video mode and command mode operation. The Bspec specifies the adjustment is valid only in video mode, and the reference Windows driver follows that constraint. Applying the adjustment in command mode shrinks htotal below a usable threshold, producing line_time_us == 0 during vtotal calculation. The subsequent arithmetic operation triggers a divide-by-zero kernel exception. The issue is classified as a kernel driver defect resulting in denial of service through driver initialization failure.

Root Cause

The root cause is incorrect application of compression-ratio-based timing adjustments in DSI command mode. The driver did not gate the adjustment on the operating mode. As a result, htotal was reduced to a value where the derived line_time_us truncated to zero, which the vtotal computation then used as a divisor.

Attack Vector

This is a local hardware-dependent issue triggered by driver initialization on systems with the affected hardware configuration. There is no indication of remote exploitation. The primary impact is a kernel crash or fault on driver load, resulting in denial of service for the affected display path. No published proof of concept exists, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

// No verified exploit code is published.
// The defect is a divide-by-zero in vtotal computation when
// line_time_us evaluates to 0 after DSC htotal adjustment in command mode.
// See upstream commits for the corrected logic.

Detection Methods for CVE-2026-31767

Indicators of Compromise

Kernel oops or panic logged during boot referencing the i915 module and DSI initialization paths.
Divide error traces in dmesg originating from DSC vtotal computation routines.
Display failure or fallback to a non-graphical console on systems with DSI command mode panels.

Detection Strategies

Inventory Linux endpoints running Intel integrated graphics with DSI command mode panels and confirm kernel build identifiers against the fixed commits.
Parse /var/log/kern.log and journalctl -k output for i915 divide-by-zero signatures and repeated driver load failures.
Compare running kernel version against patched stable branches referenced by commits 33b5336e, 4dfce79e, 55efe840, and 86e926b1.

Monitoring Recommendations

Forward kernel logs to a centralized logging system and alert on i915 driver faults during boot.
Track endpoint reboot loops and graphical session failures that correlate with kernel module load events.
Maintain a software bill of materials for Linux kernel builds across managed fleets to identify unpatched hosts quickly.

How to Mitigate CVE-2026-31767

Immediate Actions Required

Apply the upstream stable kernel update containing the cherry-picked fix from commit 0b475e91ecc2313207196c6d7fd5c53e1a878525.
Identify hosts running Intel graphics with DSI command mode displays and prioritize those for kernel patching.
Validate that vendor-provided kernel images include the corresponding stable backport before deployment.

Patch Information

The fix removes DSC horizontal timing adjustments when the DSI panel is operating in command mode and limits the adjustment to video mode, matching the Bspec and the Windows driver behavior. Patched commits are available at Kernel Git Commit 33b5336e, Kernel Git Commit 4dfce79e, Kernel Git Commit 55efe840, and Kernel Git Commit 86e926b1.

Workarounds

Boot affected systems with the i915 module blacklisted or with nomodeset until the patched kernel is installed, accepting reduced graphics functionality.
Use an external display path or alternate firmware framebuffer where supported to bypass DSI command mode initialization.
Defer kernel upgrades that pull in the affected unpatched driver code on hosts with vulnerable DSI hardware.

bash

# Verify running kernel version and check for the i915 fault signature
uname -r
journalctl -k -b | grep -iE "i915|divide error|DSI"

# After installing the patched kernel package, reboot and confirm clean load
sudo reboot
dmesg | grep -i i915