CVE-2026-43477 Overview
CVE-2026-43477 is a kernel vulnerability in the Linux drm/i915 graphics driver affecting Intel Ice Lake (ICL) platforms. The flaw involves incorrect ordering of Variable Refresh Rate (VRR) timing register writes during display pipeline initialization. Writing TRANS_VRR_VMAX and TRANS_VRR_FLIPLINE registers before enabling TRANS_DDI_FUNC_CTL can trigger a Machine Check Exception (MCE) that hangs the system. The condition has been reproduced on a Dell XPS 7390 2-in-1 when link training failed on an external display connected through a dock. Tiger Lake (TGL) systems appear unaffected. The fix reorders VRR configuration to follow TRANS_DDI_FUNC_CTL enablement, matching the sequence documented in Intel BSpec 22243.
Critical Impact
A failed DisplayPort link training event on affected ICL hardware can produce an MCE-induced system hang, denying service to the local user.
Affected Products
- Linux kernel drm/i915 driver on Intel Ice Lake (ICL) platforms
- Reproduced on Dell XPS 7390 2-in-1 with external display via Type-C dock
- Kernel branches patched via commits 237aab549676, 8a7d29b8bda1, and bf9e3b6ffd76
Discovery Timeline
- 2026-05-13 - CVE-2026-43477 published to NVD
- 2026-05-13 - Last updated in NVD database
Technical Details for CVE-2026-43477
Vulnerability Analysis
The vulnerability resides in the Intel i915 DRM driver's VRR enablement path. VRR allows the GPU to vary display refresh rate dynamically, and its timing parameters are programmed through transcoder registers such as TRANS_VRR_VMAX, TRANS_VRR_VMIN, and TRANS_VRR_FLIPLINE. On Ice Lake hardware, these registers must only be written after the corresponding DDI function control register TRANS_DDI_FUNC_CTL has been enabled.
The original driver code violated this hardware sequencing requirement. When link training fails on an external display, the driver path exercises the misordered write sequence and the CPU receives a Machine Check Exception. The MCE halts the system without producing a clean kernel oops or recovery path.
Intel's DMC firmware already implements the correct two-stage VRR restore. Stage one unconditionally restores TRANS_VRR_CTL and supporting registers. Stage two is gated on the DDI being enabled and covers TRANS_DDI_FUNC_CTL together with TRANS_VRR_VMAX/VMIN/FLIPLINE. The kernel driver now mirrors this firmware sequencing.
Root Cause
The root cause is a hardware programming-order violation classified as a kernel driver flaw. The i915 driver wrote VRR timing registers before the transcoder DDI function was active, contrary to Intel BSpec 22243 guidance. ICL silicon responds to this invalid sequence by raising an MCE, producing a denial-of-service condition.
Attack Vector
The issue is not remotely exploitable. It triggers locally when a user connects an external display whose link training fails, for example through a defective Type-C cable or dock. A local user with the ability to attach displays can reproducibly hang the affected system. The upstream fix reorders the VRR configuration steps and adds a WARN to detect future regressions of the sequencing requirement.
No public exploit code is available, and the vulnerability does not provide code execution or privilege escalation. See the kernel commit fix for the precise reordering applied to the i915 VRR enablement path.
Detection Methods for CVE-2026-43477
Indicators of Compromise
- Unexplained full-system hangs on Intel Ice Lake laptops shortly after attaching an external display via Type-C dock or adapter
- Machine Check Exception entries in mcelog or journalctl -k referencing display or graphics-related faults
- i915 driver messages indicating DisplayPort link training failures immediately preceding a hang
Detection Strategies
- Inventory Linux endpoints to identify systems running unpatched kernels on Ice Lake hardware with the i915 driver loaded
- Correlate hardware hang reports against kernel version, GPU generation, and external display usage to confirm exposure to this defect
- Review crash dumps and pstore records for MCE signatures occurring during display hotplug events
Monitoring Recommendations
- Forward dmesg, journald, and mcelog output to a centralized log platform and alert on MCE patterns paired with i915 messages
- Track kernel package versions across the fleet to verify that ICL systems receive the patched stable kernels
- Monitor user-reported display-related crash tickets to surface systems still running vulnerable kernel builds
How to Mitigate CVE-2026-43477
Immediate Actions Required
- Apply the upstream stable kernel update that includes commits 237aab549676288d9255bb8dcc284738e56eaa31, 8a7d29b8bda144d44e61df1b2705b1d4378f4e44, and bf9e3b6ffd76da38dd4961c65d80571b25bf10a5
- Prioritize patching for Ice Lake laptops and workstations that regularly connect external displays through docks or Type-C adapters
- Validate the kernel version on affected endpoints after distribution updates are installed
Patch Information
The fix reorders the i915 VRR enablement so that TRANS_VRR_VMAX, TRANS_VRR_VMIN, and TRANS_VRR_FLIPLINE are written only after TRANS_DDI_FUNC_CTL is enabled, matching Intel BSpec 22243 and DMC firmware behavior. A WARN was added to catch future regressions. Patches are available in the official kernel stable tree: primary fix commit, backport commit, and additional backport commit.
Workarounds
- Avoid connecting external displays through known-faulty Type-C cables or docks on unpatched Ice Lake systems
- Disable VRR in the desktop environment or compositor settings until the patched kernel is deployed
- Use a vendor-supported docking station with verified DisplayPort link training to reduce the chance of triggering the hang
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
