{"id":"CVE-2026-98513","kind":"vulnerability","aliases":["CVE-2026-98513"],"related":[],"title":"Linux kernel nouveau driver leaks GPU power reference on EDID failure","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: Fix runtime PM leak in nouveau_connector_detect()\n\nIf nvif_outp_edid_get() fails, nouveau_connector_detect() returns\nearly without dropping the runtime PM reference taken at the start\nof the function, keeping the device powered on until the next\nsuccessful detect.\n\nBalance the reference on the error path like the other exit paths\ndo.","summary":"In the Linux nouveau display driver, a failed EDID read in nouveau_connector_detect() returns without releasing the runtime power management reference it took. The GPU stays powered on until a later successful detect, which wastes power and can keep the device from suspending; the sources do not describe any attacker-triggered impact.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","linux","nouveau","nvidia-gpu"],"not_affected_if":["no-nvidia-gpu","proprietary-nvidia-driver"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel versions listed by your distribution for CVE-2026-98513\n- Check whether the nouveau driver is loaded with `lsmod | grep nouveau`","fix":"- Install the kernel build from your distribution that includes the upstream fix for CVE-2026-98513 and reboot\n- unknown for exact fixed kernel versions; the sources do not list them","status":"open","published_at":"2026-10-18T16:17:02+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:21+00:00","updated_at":"2026-10-25T05:25:21+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:25:21Z","model":"claude-haiku-5-5","output":{"fix":"- Install the kernel build from your distribution that includes the upstream fix for CVE-2026-98513 and reboot\n- unknown for exact fixed kernel versions; the sources do not list them","reach":"local","title":"Linux kernel nouveau driver leaks GPU power reference on EDID failure","impact":"low","summary":"In the Linux nouveau display driver, a failed EDID read in nouveau_connector_detect() returns without releasing the runtime power management reference it took. The GPU stays powered on until a later successful detect, which wastes power and can keep the device from suspending; the sources do not describe any attacker-triggered impact.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","nvidia-gpu","nouveau"],"confidence":0.6,"needs_auth":"unknown","worst_case":"GPU stays powered on, draining power and blocking suspend","analyst_note":"","how_to_check":"- Run `uname -r` and compare against the fixed kernel versions listed by your distribution for CVE-2026-98513\n- Check whether the nouveau driver is loaded with `lsmod | grep nouveau`","needs_analyst":false,"not_affected_if":["proprietary-nvidia-driver","no-nvidia-gpu"],"who_is_affected":"Only systems running Linux with the open-source nouveau driver for NVIDIA GPUs are exposed, and the effect is a device that stays powered up rather than a security compromise. Systems using the proprietary NVIDIA driver, or machines without NVIDIA hardware, are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000626,"input_tokens":3359,"output_tokens":581,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98513':14A,17A 'attack':76B 'attacker-trigg':75B 'balanc':132C 'connector':37B,96C,105C 'cve':12A,15A 'describ':73B 'detect':38B,58B,97C,106C,131C 'devic':66B,124C 'display':29B 'driver':4A,30B 'drm/nouveau':89C 'drop':110C 'earli':108C 'edid':10A,33B,101C 'error':137C 'exit':142C 'fail':32B,103C 'failur':11A 'fix':90C 'follow':84C 'function':121C 'get':102C 'gpu':6A,24B,50B 'impact':78B 'infrastructur':18B 'keep':64B,122C 'kernel':2A,19B,82C 'later':56B 'leak':5A,93C 'like':139C 'linux':1A,20B,27B,81C 'manag':45B 'next':129C 'nouveau':3A,21B,28B,36B,95C,104C 'nvidia':23B 'nvidia-gpu':22B 'nvif':99C 'outp':100C 'path':138C,143C 'pm':92C,113C 'power':7A,44B,52B,61B,125C 'read':34B 'refer':8A,46B,114C,134C 'releas':41B 'resolv':88C 'return':39B,107C 'runtim':43B,91C,112C 'sourc':70B 'start':118C 'stay':51B 'success':57B,130C 'suspend':68B 'taken':115C 'took':48B 'trigger':77B 'vulner':85C 'wast':60B 'without':40B,109C","nicknames":[],"mitigations":[],"who_affected":"Only systems running Linux with the open-source nouveau driver for NVIDIA GPUs are exposed, and the effect is a device that stays powered up rather than a security compromise. Systems using the proprietary NVIDIA driver, or machines without NVIDIA hardware, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:02+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98513","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98513","severity":null,"published_at":"2026-10-18T16:17:02+00:00","modified_at":"2026-10-19T10:19:04+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}