CVE-2026-68254: Linux Kernel i915 VRR Division by Zero

CVE-2026-68254 Overview

CVE-2026-68254 affects the Linux kernel's Intel i915 graphics driver, specifically the Variable Refresh Rate (VRR) implementation. The vulnerability exists in the drm/i915/vrr code path, where the driver fails to explicitly validate the minimum and maximum vertical frequency (vfreq) values provided by the display's Extended Display Identification Data (EDID). A zero min_vfreq value can trigger a division-by-zero condition in intel_vrr_compute_vmax(). The issue was discovered using AI-assisted static analysis and confirmed by Intel Product Security.

Critical Impact
A crafted or malformed EDID with a zero min_vfreq value can cause a kernel-level division by zero, resulting in a denial of service on affected Linux systems using Intel graphics with VRR-capable displays.

Affected Products

Linux kernel Intel i915 DRM driver (VRR subsystem)
Systems using Intel integrated graphics with Variable Refresh Rate displays
Multiple stable kernel branches (fixes cherry-picked across five stable trees)

Discovery Timeline

2026-08-10 - CVE-2026-68254 published to the National Vulnerability Database (NVD)
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68254

Vulnerability Analysis

The vulnerability resides in the Direct Rendering Manager (DRM) subsystem, specifically in the Intel i915 driver's Variable Refresh Rate handling code. Variable Refresh Rate is a display technology that synchronizes the display's refresh rate with the GPU's frame output. The driver relies on min_vfreq and max_vfreq values reported through EDID data provided by the connected display.

According to the upstream commit message, most exploitation scenarios were already covered by coincidence through checks in intel_vrr_is_capable() and intel_vrr_is_in_range(). However, these checks were not explicit guarantees. The fix requires valid min/max vfreq values before VRR configuration proceeds. The issue was identified via AI-assisted static analysis and confirmed by Intel Product Security.

Root Cause

The root cause is missing explicit input validation on EDID-provided vfreq values before they are used in arithmetic operations within intel_vrr_compute_vmax(). When min_vfreq equals zero, division operations that use this value as a divisor trigger a kernel division-by-zero fault. This represents an improper input validation flaw in a kernel driver.

Attack Vector

Exploitation requires an attacker to influence the EDID data presented to the target system. This can occur when a user connects a malicious display, an attacker-controlled display emulator, or a device that spoofs EDID fields over DisplayPort or HDMI. Remote exploitation is not the typical vector; the flaw requires physical or peripheral-level access to attach a display device that reports crafted EDID values with an invalid min_vfreq.

No verified exploit code is publicly available. Technical details are documented in the upstream kernel commits referenced in the kernel.org stable tree.

Detection Methods for CVE-2026-68254

Indicators of Compromise

Unexpected kernel panics or oops messages referencing intel_vrr_compute_vmax or the i915 VRR code path
Kernel log entries showing division-by-zero faults in the DRM subsystem
System crashes correlated with display hotplug events or EDID re-reads

Detection Strategies

Monitor dmesg and journalctl -k output for i915 driver faults and DRM subsystem errors
Audit connected display peripherals and EDID data using tools such as edid-decode and read-edid
Correlate host crash telemetry with USB, DisplayPort, or HDMI hotplug events on endpoints with Intel graphics

Monitoring Recommendations

Centralize Linux kernel logs and DRM subsystem messages into a SIEM for pattern analysis across the fleet
Track kernel version inventory to identify hosts running unpatched i915 driver code
Alert on repeated crashes on the same host that coincide with peripheral device attachment events

How to Mitigate CVE-2026-68254

Immediate Actions Required

Apply the latest stable Linux kernel update from your distribution containing the drm/i915/vrr fix
Inventory endpoints and servers using Intel integrated graphics with VRR-capable displays
Restrict physical and peripheral access to systems where display peripherals cannot be trusted

Patch Information

The fix requires valid EDID-provided min/max vfreq values before VRR features are enabled. The corrective patch was cherry-picked from upstream commit 1765cf59f517b02f3b0591fe5120930d08bddeb6 into multiple stable branches. Refer to the following commits for the applied fixes: 6598ac1721c3, c726c8bbee51, df1582c0a101, f16218689b41, and f8a9262c7a6f.

Workarounds

Disable Variable Refresh Rate support on affected systems until patches are applied
Avoid connecting untrusted or unknown display devices to systems running vulnerable kernel versions
Use only vetted, known-good monitors on production Linux systems with Intel graphics

bash

# Verify current kernel version and check for the i915 VRR fix
uname -r

# Inspect kernel logs for i915 or DRM faults
journalctl -k | grep -Ei 'i915|drm|vrr'

# Decode EDID from a connected display to review reported vfreq values
for edid in /sys/class/drm/*/edid; do
    [ -s "$edid" ] && echo "== $edid ==" && edid-decode "$edid"
done