CVE-2026-89822: Linux Kernel i915 Use-After-Free Vulnerability

CVE-2026-89822 Overview

CVE-2026-89822 is a NULL pointer dereference vulnerability in the Linux kernel's Intel i915 Direct Rendering Manager (DRM) graphics driver. The flaw resides in the i915_pci_probe() function, which handles PCI device probing for Intel graphics hardware. When a device is force-bound through the sysfs driver_override mechanism, pci_match_device() can return the dummy pci_device_id_any entry whose ->driver_data field is unset. The probe function then casts this NULL value to struct intel_device_info * and dereferences intel_info->require_force_probe, triggering a kernel NULL pointer dereference.

Critical Impact
A local user with privileges to write to sysfs driver_override can trigger a kernel NULL pointer dereference in the i915 driver, resulting in a denial of service condition on affected Linux systems.

Affected Products

Linux kernel — mainline versions containing the i915 DRM driver prior to the referenced fix commits
Stable kernel branches receiving the cherry-picked backport from commit 2727922084672cc274ecea726ea00363c2893731
Distributions shipping unpatched Linux kernels with Intel graphics support enabled

Discovery Timeline

2026-09-16 - CVE-2026-89822 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-89822

Vulnerability Analysis

The vulnerability affects the Intel i915 graphics driver PCI probe path. The i915_pci_probe() function receives a pci_device_id structure from the kernel's PCI subsystem and unconditionally treats its driver_data field as a pointer to struct intel_device_info. This assumption is valid for entries defined in the driver's device ID table, where driver_data points to per-device metadata. However, when a device is force-bound via the sysfs driver_override interface, the PCI core routes the match through a synthetic pci_device_id_any entry that has no associated driver_data. The probe function then reads intel_info->require_force_probe from a NULL pointer, causing an in-kernel NULL pointer dereference [CWE-476].

Root Cause

The root cause is a missing input validation check on the driver_data field returned by pci_match_device(). The i915 driver assumes every match returned by the PCI core carries valid intel_device_info metadata. The fix adds a guard that verifies driver_data is non-NULL before dereferencing it, aligning the driver with the semantics of driver_override-based binding.

Attack Vector

Exploitation requires local access with sufficient privileges to write to /sys/bus/pci/devices/<bdf>/driver_override and to trigger a rebind of a PCI device to the i915 driver. Successfully forcing an unsupported device onto i915 through this path causes the kernel to dereference NULL in the probe routine, producing an oops and, depending on kernel configuration, a kernel panic. The vulnerability does not provide a remote attack surface and does not directly expose kernel memory contents.

No public proof-of-concept exploit code is referenced in the enriched CVE data. Technical details are available in the upstream commits published on git.kernel.org.

Detection Methods for CVE-2026-89822

Indicators of Compromise

Kernel oops or panic messages referencing i915_pci_probe in the call trace, accompanied by a NULL pointer dereference at a low address.
Unexpected writes to /sys/bus/pci/drivers/i915/bind or /sys/bus/pci/devices/*/driver_override in audit logs.
System crashes or GPU subsystem failures immediately following PCI rebind operations.

Detection Strategies

Monitor kernel ring buffer (dmesg) and /var/log/kern.log for BUG: unable to handle kernel NULL pointer dereference entries with i915 symbols.
Use auditd rules to track write access to sysfs paths under /sys/bus/pci/ that control driver binding and overrides.
Correlate unexpected reboots on hosts with Intel graphics against recent PCI subsystem activity in system logs.

Monitoring Recommendations

Enable persistent kernel crash dump collection (kdump) to preserve oops traces for post-incident analysis.
Track kernel version inventory across the fleet to identify hosts running i915 builds prior to the fix commits listed on git.kernel.org.
Alert on process invocations that write to PCI driver_override or bind/unbind sysfs files outside of expected administrative workflows.

How to Mitigate CVE-2026-89822

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 18b3433f10ee, 2239e6b49d33, 3785d40831ba, 4a0236fe9773, 84829e324a39, and e351cb2d373f from the stable trees.
Update to a distribution kernel package that incorporates the i915 driver_data NULL guard.
Restrict access to PCI sysfs binding interfaces to trusted administrators only.

Patch Information

The fix adds a NULL check on driver_data in i915_pci_probe() before dereferencing it as struct intel_device_info *. The change is cherry-picked from mainline commit 2727922084672cc274ecea726ea00363c2893731 into multiple stable branches. Patch details are available at the Linux Kernel stable tree.

Workarounds

Avoid using the sysfs driver_override mechanism to force-bind non-Intel PCI devices to the i915 driver.
Limit root and CAP_SYS_ADMIN privileges on systems where kernel updates cannot be applied immediately.
Deny write access to /sys/bus/pci/devices/*/driver_override using mandatory access control policies (SELinux, AppArmor).

bash

# Example SELinux/AppArmor-style restriction concept for sysfs driver_override
# Verify running kernel version and check for the fix
uname -r
grep -r "require_force_probe" /usr/src/linux/drivers/gpu/drm/i915/i915_pci.c

# Audit rule to log writes to PCI driver_override sysfs entries
auditctl -w /sys/bus/pci/drivers/i915/bind -p wa -k i915_bind
auditctl -w /sys/bus/pci/ -p wa -k pci_driver_override