{"id":"CVE-2026-98623","kind":"vulnerability","aliases":["CVE-2026-98623"],"related":[],"title":"Linux kernel: Nouveau clock debugfs write reads past a list head","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update\n\nIf list_for_each_entry() exits without hitting a break then \"pstate\" is\nnot a valid pstate pointer.  Introduce a \"found\" variable instead.\n\nThe check is reachable from userspace: nvkm_clk_ustate_update() takes the\npstate id straight from the 'pstate' debugfs file, so requesting an id\nthat is not in clk->states - or any id at all when the perf tables are\nbroken and the list is empty - makes the pstate->pstate != req test\ndereference the list head cast to a struct nvkm_pstate, which is an\nout-of-bounds read.\n\n[Francesco: rebased on drm-misc-next, expanded the commit message]","summary":"The Nouveau GPU driver's clock code, when handed an unknown performance-state id through the pstate debugfs file, reads memory past the end of a list. The result is an out-of-bounds read in kernel memory that can crash the machine or leak nearby data.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-linux","linux-kernel","nouveau","nvidia-gpu","runtime"],"not_affected_if":["debugfs-not-mounted","no-nvidia-gpu","nouveau-not-loaded","proprietary-driver"],"how_to_check":"- `uname -r` and compare against the patched kernel versions listed by the distribution or kernel.org stable tree\n- `lsmod | grep nouveau` to see whether the Nouveau driver is loaded at all\n- Check whether `/sys/kernel/debug/dri/*/pstate` exists, which means debugfs exposes the file","fix":"- Update the Linux kernel to a stable release that includes the commit 'drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update'; exact fixed version unknown from sources\n- Unload the nouveau module or blacklist it on hosts that use the proprietary NVIDIA driver or no NVIDIA GPU","status":"open","published_at":"2026-10-18T16:17:15+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:13+00:00","updated_at":"2026-10-25T05:21:13+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:21:13Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a stable release that includes the commit 'drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update'; exact fixed version unknown from sources\n- Unload the nouveau module or blacklist it on hosts that use the proprietary NVIDIA driver or no NVIDIA GPU","reach":"local","title":"Linux kernel: Nouveau clock debugfs write reads past a list head","impact":"low","summary":"The Nouveau GPU driver's clock code, when handed an unknown performance-state id through the pstate debugfs file, reads memory past the end of a list. The result is an out-of-bounds read in kernel memory that can crash the machine or leak nearby data.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","nouveau","nvidia-gpu","desktop-linux"],"confidence":0.6,"needs_auth":"yes","worst_case":"kernel memory read out of bounds, possible crash or data leak","analyst_note":"","how_to_check":"- `uname -r` and compare against the patched kernel versions listed by the distribution or kernel.org stable tree\n- `lsmod | grep nouveau` to see whether the Nouveau driver is loaded at all\n- Check whether `/sys/kernel/debug/dri/*/pstate` exists, which means debugfs exposes the file","needs_analyst":false,"not_affected_if":["no-nvidia-gpu","proprietary-driver","debugfs-not-mounted","nouveau-not-loaded"],"who_is_affected":"Only systems running the Nouveau open-source NVIDIA driver with debugfs mounted are exposed, typically Linux desktops and workstations with NVIDIA GPUs. Servers without a GPU, hosts using the proprietary driver, and systems without debugfs can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000688,"input_tokens":3489,"output_tokens":679,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98623':14A,17A 'bound':64B,191C 'break':109C 'broken':163C 'cast':179C 'check':124C 'clk':97C,130C,151C 'clock':4A,34B 'code':35B 'commit':202C 'crash':71B 'cursor':91C 'cve':12A,15A 'data':77B 'debugf':5A,47B,141C 'derefer':175C 'desktop':19B 'desktop-linux':18B 'driver':32B 'drm':197C 'drm-misc-next':196C 'drm/nouveau/clk':88C 'empti':168C 'end':53B 'entri':104C 'exit':105C 'expand':200C 'file':48B,142C 'fix':89C 'follow':83C 'found':120C 'francesco':193C 'gpu':27B,31B 'hand':37B 'head':11A,178C 'hit':107C 'id':43B,136C,146C,155C 'instead':122C 'introduc':118C 'kernel':2A,23B,67B,81C 'leak':75B 'linux':1A,20B,22B,80C 'linux-kernel':21B 'list':10A,56B,90C,101C,166C,177C 'loop':94C 'machin':73B 'make':169C 'memori':50B,68B 'messag':203C 'misc':198C 'nearbi':76B 'next':199C 'nouveau':3A,24B,30B 'nvidia':26B 'nvidia-gpu':25B 'nvkm':96C,129C,183C 'out-of-bound':61B,188C 'past':8A,51B 'perf':160C 'perform':41B 'performance-st':40B 'pointer':117C 'pstate':46B,111C,116C,135C,140C,171C,172C,184C 'reachabl':126C 'read':7A,49B,65B,192C 'rebas':194C 'req':173C 'request':144C 'resolv':87C 'result':58B 'runtim':28B 'state':42B,152C 'straight':137C 'struct':182C 'tabl':161C 'take':133C 'test':174C 'unknown':39B 'updat':99C,132C 'use':92C 'userspac':128C 'ustat':98C,131C 'valid':115C 'variabl':121C 'vulner':84C 'without':106C 'write':6A","nicknames":[],"mitigations":[],"who_affected":"Only systems running the Nouveau open-source NVIDIA driver with debugfs mounted are exposed, typically Linux desktops and workstations with NVIDIA GPUs. Servers without a GPU, hosts using the proprietary driver, and systems without debugfs can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98623","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98623","severity":null,"published_at":"2026-10-18T16:17:15+00:00","modified_at":"2026-10-19T10:19:26+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}