CVE-2026-23467: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23467 is a NULL pointer dereference vulnerability in the Linux kernel's Intel i915 DRM driver, specifically in the intel_dmc_update_dc6_allowed_count() function. The flaw occurs when the Display Mode Control (DMC) subsystem has not yet been initialized but the function is called during display core initialization, resulting in a kernel oops (crash). Affected versions include Linux kernel 6.16.x through 6.18.19, 6.19.x through 6.19.9, and release candidates 7.0-rc1 through 7.0-rc4. It was published on April 3, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory).

The root cause is a NULL pointer dereference (CWE-476) in the intel_dmc_update_dc6_allowed_count() function within the drm/i915/dmc subsystem. The vulnerable call path is intel_power_domains_init_hw() → {skl,bxt,icl}_display_core_init() → gen9_set_dc_state() → intel_dmc_update_dc6_allowed_count(), where intel_power_domains_init_hw() is invoked before intel_dmc_init(), leaving the dmc pointer as NULL. The function is called conditionally based on DC states; at probe time, if DC6 is enabled in hardware (typically due to BIOS leaving an unintentional DC6 HW state without loading the required DMC firmware), the NULL dereference is triggered. The fix corrects the logic to use the software DC6 state rather than the hardware DC6 state for tracking (GitHub Advisory).

Successful exploitation causes a kernel oops (crash), resulting in a denial of service on the affected system. The impact is limited to availability — there is no confidentiality or integrity impact. A local user with low privileges on a system with Intel i915 graphics hardware where DC6 is unexpectedly enabled in BIOS can trigger the crash, potentially causing system downtime or requiring a reboot (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability requires local access with low privileges and is only triggerable under a specific and unlikely hardware condition — DC6 being enabled in BIOS without the corresponding DMC firmware loaded. The EPSS score is approximately 0.017% (5th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

Patches are available in Linux kernel versions 6.18.20, 6.19.10, and 7.0-rc5 or later. Three upstream stable commits address the issue: 0b35d11fbbcfd1079c8489282a341944228835e3, 631317825d44283abfe7a8374f13a76ce2032bb8, and ac57eb3b7d2ad649025b5a0fa207315f755ac4f6. As a workaround, administrators can disable the DC6 power state in BIOS settings if the option is available, or update the system BIOS to prevent DC6 from being unintentionally left enabled without proper DMC firmware loading. Amazon Linux 2023 users should apply the update referenced in ALAS2023-2026-1596 (GitHub Advisory).