CVE-2026-68241: Linux Kernel i915 MST DoS Vulnerability

CVE-2026-68241 Overview

CVE-2026-68241 is a Linux kernel vulnerability in the Intel i915 DRM (Direct Rendering Manager) graphics driver. The flaw resides in the intel_dp_check_mst_status() function, which handles DisplayPort Multi-Stream Transport (MST) External Sink Interrupts (ESI). The interrupt service loop lacks an upper bound on the number of new interrupts processed per invocation. A malfunctioning or malicious DisplayPort MST sink device can keep generating interrupts, causing the kernel to remain stuck servicing them indefinitely.

The issue was discovered using AI-assisted static analysis and confirmed by Intel Product Security. The upstream fix caps the retry counter at an arbitrary 32 iterations to bound the service loop.

Critical Impact
A stuck or hostile DP MST sink device can indefinitely occupy kernel interrupt-servicing context in the i915 driver, leading to system hangs or denial of service on affected Linux hosts with Intel graphics.

Affected Products

Linux kernel with the Intel i915 DRM driver enabled
Systems using DisplayPort Multi-Stream Transport (MST) sinks connected to Intel graphics
Distributions shipping kernels prior to the commits referenced in the upstream fix

Discovery Timeline

2026-08-10 - CVE-2026-68241 published to the National Vulnerability Database
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68241

Vulnerability Analysis

The DisplayPort MST protocol allows a single DP output to drive multiple downstream sink devices through a topology of branch devices. Sinks signal events such as hot-plug changes and link status updates by asserting ESI (External Sink Interrupt) messages that the source reads through DPCD (DisplayPort Configuration Data) registers.

Inside the i915 driver, intel_dp_check_mst_status() reads the ESI registers, dispatches handlers for the raised events, then acknowledges them back to the sink. After acknowledgement, the driver re-reads the ESI registers to check for interrupts that arrived during processing. This retry logic previously had no termination bound: if the sink continuously raised new interrupts, the loop would keep servicing them without returning control.

The classification aligns with a resource-exhaustion Denial of Service condition, specifically an unbounded loop driven by attacker-controllable external input from the connected sink device.

Root Cause

The root cause is missing loop bounds in the ESI service path. The code trusted the sink to eventually stop asserting interrupts, but a faulty or adversarial MST device can hold the interrupt line indefinitely. Without a maximum retry counter, the kernel thread servicing the interrupt cannot make forward progress.

Attack Vector

An attacker with physical access to a DisplayPort connector, or control over an MST hub or dock attached to the target, can present a sink that continuously raises ESI interrupts. Once the driver enters intel_dp_check_mst_status(), the loop repeatedly reads and acknowledges interrupts without exiting, consuming kernel CPU time and blocking normal display processing.

The vulnerability does not require authentication on the host but does require the ability to attach or emulate a DisplayPort MST device. Exploitation results in denial of service rather than code execution or privilege escalation.

The upstream fix, referenced in commits 005771c, 9061fbf, and e3bcd3b, introduces a bound of 32 retries before the loop exits, allowing the driver to yield if the sink misbehaves.

Detection Methods for CVE-2026-68241

Indicators of Compromise

Repeated kernel soft-lockup or rcu_sched stall warnings referencing the i915 module or intel_dp_check_mst_status in the stack trace
Unresponsive display output or GPU hangs shortly after connecting a DisplayPort MST hub, dock, or monitor
High kernel-mode CPU utilization on threads handling DRM interrupts with no corresponding user workload

Detection Strategies

Monitor dmesg and journalctl -k for kernel warnings originating in drivers/gpu/drm/i915/display/intel_dp.c and DP MST helpers
Correlate physical hot-plug events on DisplayPort connectors with subsequent kernel stalls to identify malicious or defective sinks
Baseline installed kernel versions across the fleet and flag hosts running unpatched builds that use Intel graphics

Monitoring Recommendations

Ingest kernel logs and hardware telemetry into a centralized logging pipeline for stall and lockup pattern analysis
Alert on repeated GPU reset events or DRM subsystem errors from endpoints with Intel integrated graphics
Track DisplayPort peripheral connection events on shared or public-access workstations where hostile devices are plausible

How to Mitigate CVE-2026-68241

Immediate Actions Required

Identify Linux hosts running kernels that include the i915 driver and validate whether the ESI loop bound patch is present
Apply the latest stable kernel updates from your distribution vendor that incorporate the upstream fix commits
Restrict physical access to DisplayPort ports on kiosks, lab systems, and shared workstations where untrusted devices could be attached

Patch Information

The fix is applied by the upstream commits 005771c18c5b, 9061fbf2230b, and e3bcd3bf7eec, which cap the ESI service retry count at 32 iterations. The referenced patch is cherry-picked from upstream commit b4ea5272133059acb493cc36599071a9e852ec2e. Rebuild or update to a kernel package containing these commits and reboot affected systems.

Workarounds

Avoid connecting untrusted DisplayPort MST hubs, docks, or monitors to affected systems until the patched kernel is deployed
Disable the i915 driver on systems that do not require Intel graphics output by blacklisting the module in /etc/modprobe.d/
Where feasible, use single-stream (non-MST) DisplayPort connections, since the vulnerable code path is specific to MST ESI handling

bash

# Verify running kernel version and i915 module state
uname -r
lsmod | grep i915

# Check dmesg for i915 MST-related warnings
dmesg | grep -Ei 'i915|drm|mst|intel_dp'

# Example: blacklist i915 on systems that do not require it
echo 'blacklist i915' | sudo tee /etc/modprobe.d/blacklist-i915.conf
sudo update-initramfs -u