← CVE announcements

SECURITY ANNOUNCEMENT

CVE-2026-99118

28 October 2026

Validate the conversion of the DMC firmware size from dwords to bytes using check_mul_overflow() before calculating the firmware payload size.

Reject zero-length payloads and zero MMIO counts in the DMC firmware header so malformed firmware is caught early. Also set dmc_fw_size only after the payload allocation succeeds.

(cherry picked from commit efde6601a1f1daedfe3dcc2816c934ddb44e3eef)

Introduced

4.2 eb805623d8b161342ed9c9caf366f0a295041a6d

Fixed releases

6.18.59 dfcfe2874e7c16e8460dc86ac1eeb54ea0e7f8aa

7.2.13 05f7a2f712f8b287a98ee61a7c2c6b72dad2fc6d

7.3 8bb1858db453cd4250e3b633f5d2d09206024ca6

View source announcement ↗