CVE-2026-43368

In the Linux kernel, the following vulnerability has been resolved:

drm/i915: Fix potential overflow of shmem scatterlist length

When a scatterlists table of a GEM shmem object of size 4 GB or more is populated with pages allocated from a folio, unsigned int .length attribute of a scatterlist may get overflowed if total byte length of pages allocated to that single scatterlist happens to reach or cross the 4GB limit. As a consequence, users of the object may suffer from hitting unexpected, premature end of the object's backing pages.

[278.780187] ------------[ cut here ]------------ [278.780377] WARNING: CPU: 1 PID: 2326 at drivers/gpu/drm/i915/i915mm.c:55 remapsg+0x199/0x1d0 [i915] ... [278.780654] CPU: 1 UID: 0 PID: 2326 Comm: gemmmapoffset Tainted: G S U 6.17.0-rc1-CIDRM16981-ged823aaa0607+ #1 PREEMPT(voluntary) [278.780656] Tainted: [S]=CPUOUTOFSPEC, [U]=USER [278.780658] Hardware name: Intel Corporation Meteor Lake Client Platform/MTL-P LP5x T3 RVP, BIOS MTLPFWI1.R00.3471.D91.2401310918 01/31/2024 [278.780659] RIP: 0010:remapsg+0x199/0x1d0 [i915] ... [278.780786] Call Trace: [278.780787] <TASK> [278.780788] ? __applytopage_range+0x3e6/0x910 [278.780795] ? __pfxremapsg+0x10/0x10 [i915] [278.780906] apply_topagerange+0x14/0x30 [278.780908] remapiosg+0x14d/0x260 [i915] [278.781013] vmfaultcpu+0xd2/0x330 [i915] [278.781137] __dofault+0x3a/0x1b0 [278.781140] dofault+0x322/0x640 [278.781143] __handlemmfault+0x938/0xfd0 [278.781150] handlemmfault+0x12c/0x300 [278.781152] ? lockmmandfindvma+0x4b/0x760 [278.781155] douseraddrfault+0x2d6/0x8e0 [278.781160] excpagefault+0x96/0x2c0 [278.781165] asmexcpagefault+0x27/0x30 ...

That issue was apprehended by the author of a change that introduced it, and potential risk even annotated with a comment, but then never addressed.

When adding folio pages to a scatterlist table, take care of byte length of any single scatterlist not exceeding max_segment.

(cherry picked from commit 06249b4e691a75694c014a61708c007fb5755f60)