Live › vulnerability › CVE-2026-98623
Go to dashboardThe Nouveau GPU driver's clock code, when handed an unknown performance-state id through the pstate debugfs file, reads memory past the end of a list. The result is an out-of-bounds read in kernel memory that can crash the machine or leak nearby data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems running the Nouveau open-source NVIDIA driver with debugfs mounted are exposed, typically Linux desktops and workstations with NVIDIA GPUs. Servers without a GPU, hosts using the proprietary driver, and systems without debugfs can skip it.
No product ranges from the sources yet.
uname -r and compare against the patched kernel versions listed by the distribution or kernel.org stable treelsmod | grep nouveau to see whether the Nouveau driver is loaded at all/sys/kernel/debug/dri/*/pstate exists, which means debugfs exposes the fileEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
If list_for_each_entry() exits without hitting a break then "pstate" is not a valid pstate pointer. Introduce a "found" variable instead.
The check is reachable from userspace: nvkm_clk_ustate_update() takes the pstate id straight from the 'pstate' debugfs file, so requesting an id that is not in clk->states - or any id at all when the perf tables are broken and the list is empty - makes the pstate->pstate != req test dereference the list head cast to a struct nvkm_pstate, which is an out-of-bounds read.
[Francesco: rebased on drm-misc-next, expanded the commit message]
This page as .md · .json · in your agent: get_signal("CVE-2026-98623")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.