CVE-2026-31767: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31767 is a divide-by-zero vulnerability in the Linux kernel's DRM i915 DSI display driver that can cause a kernel panic (denial of service) during driver initialization on affected hardware. The flaw stems from incorrect application of DSC (Display Stream Compression) horizontal timing adjustments in command mode, which should only be applied in video mode. It affects Linux kernel versions from 5.6 up to (but not including) 6.12.81, 6.13 through 6.18.21, 6.19 through 6.19.11, and 7.0 release candidates up to rc6. It was published on May 1, 2026, with a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-369 (Divide By Zero). In the drm/i915/dsi driver, horizontal timing values are incorrectly adjusted based on the DSC compression ratio even when operating in command mode — an adjustment that the hardware specification (Bspec) indicates should only occur in video mode. This miscalculation causes the adjusted htotal value to become so small that line_time_us evaluates to zero, triggering a division-by-zero when the driver subsequently attempts to calculate the vtotal value during initialization. The vulnerability is locally exploitable with low privileges and no user interaction required, as it is triggered when the i915 driver loads on systems with DSC-capable Intel GPUs using DSI displays (e.g., Huawei Matebook E). The upstream fix (cherry-picked from commit 0b475e91ecc2313207196c6d7fd5c53e1a878525) stops applying DSC horizontal timing adjustments in command mode (GitHub Advisory).

Successful triggering of this vulnerability results in a kernel panic, causing an immediate system crash and complete denial of service requiring a reboot. The impact is limited to availability — there is no confidentiality or integrity impact. Affected systems are those running vulnerable Linux kernel versions with DSC-capable Intel GPUs in DSI command mode configurations; the crash occurs at driver load time, meaning affected machines may be rendered unbootable or unstable until the driver is patched or disabled (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (3rd percentile), indicating a very low probability of exploitation in the near term (GitHub Advisory). Exploitation requires local access with low privileges on hardware specifically equipped with a DSC-capable Intel GPU using a DSI display interface in command mode, significantly limiting the attack surface.

Update the Linux kernel to a patched stable version: 6.12.81 or later (for the 5.6–6.12 branch), 6.18.22 or later (for the 6.13–6.18 branch), or 6.19.12 or later (for the 6.19 branch); the fix is also included in Linux 7.0. Patches are available via the stable kernel tree at git.kernel.org (GitHub Advisory, Feedly). As a temporary workaround on systems that cannot be updated immediately, disabling the i915 driver (if an alternative graphics driver is available) will prevent the crash. Linux distribution users should consult their vendor (e.g., Red Hat via Red Hat Bugzilla) for backported patches applicable to their supported kernel branches.