---
id: "CVE-2026-98623"
kind: "vulnerability"
aliases: ["CVE-2026-98623"]
title: "Linux kernel: Nouveau clock debugfs write reads past a list head"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["desktop-linux", "linux-kernel", "nouveau", "nvidia-gpu", "runtime"]
not_affected_if: ["debugfs-not-mounted", "no-nvidia-gpu", "nouveau-not-loaded", "proprietary-driver"]
published_at: "2026-10-18T16:17:15+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:21:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98623", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel: Nouveau clock debugfs write reads past a list head

The Nouveau GPU driver's clock code, when handed an unknown performance-state id through the pstate debugfs file, reads memory past the end of a list. The result is an out-of-bounds read in kernel memory that can crash the machine or leak nearby data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` and compare against the patched kernel versions listed by the distribution or kernel.org stable tree
- `lsmod | grep nouveau` to see whether the Nouveau driver is loaded at all
- Check whether `/sys/kernel/debug/dri/*/pstate` exists, which means debugfs exposes the file

## Fix

- Update the Linux kernel to a stable release that includes the commit 'drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update'; exact fixed version unknown from sources
- Unload the nouveau module or blacklist it on hosts that use the proprietary NVIDIA driver or no NVIDIA GPU

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98623

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update

If list_for_each_entry() exits without hitting a break then "pstate" is
not a valid pstate pointer.  Introduce a "found" variable instead.

The check is reachable from userspace: nvkm_clk_ustate_update() takes the
pstate id straight from the 'pstate' debugfs file, so requesting an id
that is not in clk->states - or any id at all when the perf tables are
broken and the list is empty - makes the pstate->pstate != req test
dereference the list head cast to a struct nvkm_pstate, which is an
out-of-bounds read.

[Francesco: rebased on drm-misc-next, expanded the commit message]

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_