{"id":"CVE-2026-98886","kind":"vulnerability","aliases":["CVE-2026-98886"],"related":[],"title":"Linux kernel: gma500 HDMI I2C reads can hang and ignore errors","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gma500: return errors from Oaktrail HDMI I2C reads\n\nxfer_read() waits for the HDMI I2C transaction to reach\nI2C_TRANSACTION_DONE, but it ignores both timeout and signal returns from\nwait_for_completion_interruptible_timeout().  If the interrupt never\nadvances the transaction state, the loop can wait forever.\n\nReturn -ETIMEDOUT when the completion wait expires, propagate interrupted\nwaits, and make the I2C master_xfer callback return the first transfer\nerror instead of reporting a successful message count.","summary":"In the Linux gma500 display driver for Oaktrail HDMI, I2C reads ignored timeouts and signal interrupts, so a missing interrupt could leave the read waiting forever. The fix makes the driver return the errors instead, so an attacker mainly gains a possible hang of the display path.","severity":"unknown","cvss":null,"epss":0.00215,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gma500","infrastructure","intel-hardware","linux-kernel","oaktrail"],"not_affected_if":["driver-not-loaded","no-gma500-hardware"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit 'drm/gma500: return errors from Oaktrail HDMI I2C reads' (the sources do not name a version).","status":"open","published_at":"2026-10-23T12:18:22+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T05:00:05+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:00:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit 'drm/gma500: return errors from Oaktrail HDMI I2C reads' (the sources do not name a version).","reach":"local","title":"Linux kernel: gma500 HDMI I2C reads can hang and ignore errors","impact":"low","summary":"In the Linux gma500 display driver for Oaktrail HDMI, I2C reads ignored timeouts and signal interrupts, so a missing interrupt could leave the read waiting forever. The fix makes the driver return the errors instead, so an attacker mainly gains a possible hang of the display path.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","gma500","oaktrail","intel-hardware"],"confidence":0.5,"needs_auth":"unknown","worst_case":"a kernel display I2C read may hang indefinitely","analyst_note":"Check the NVD entry and the upstream kernel commit for affected and fixed kernel versions and whether the hang is reachable by a non-privileged user.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-gma500-hardware","driver-not-loaded"],"who_is_affected":"Systems running Linux kernels with the gma500 DRM driver and Oaktrail (Intel Atom Oaktrail-era) HDMI output. Systems without this hardware or without the gma500 driver loaded can skip it. The sources do not say which kernel versions are fixed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000621,"input_tokens":3434,"output_tokens":555,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98886':14A,17A 'advanc':123C 'attack':64B 'callback':148C 'complet':116C,136C 'could':47B 'count':160C 'cve':12A,15A 'display':31B,72B 'done':104C 'driver':32B,57B 'drm/gma500':84C 'error':11A,60B,86C,153C 'etimedout':133C 'expir':138C 'first':151C 'fix':54B 'follow':79C 'forev':52B,131C 'gain':66B 'gma500':3A,18B,30B 'hang':8A,69B 'hardwar':22B 'hdmi':4A,35B,89C,97C 'i2c':5A,36B,90C,98C,102C,145C 'ignor':10A,38B,107C 'infrastructur':19B 'instead':61B,154C 'intel':21B 'intel-hardwar':20B 'interrupt':42B,46B,117C,121C,140C 'kernel':2A,25B,77C 'leav':48B 'linux':1A,24B,29B,76C 'linux-kernel':23B 'loop':128C 'main':65B 'make':55B,143C 'master':146C 'messag':159C 'miss':45B 'never':122C 'oaktrail':26B,34B,88C 'path':73B 'possibl':68B 'propag':139C 'reach':101C 'read':6A,37B,50B,91C,93C 'report':156C 'resolv':83C 'return':58B,85C,112C,132C,149C 'signal':41B,111C 'state':126C 'success':158C 'timeout':39B,109C,118C 'transact':99C,103C,125C 'transfer':152C 'vulner':80C 'wait':51B,94C,114C,130C,137C,141C 'xfer':92C,147C","nicknames":[],"mitigations":[],"who_affected":"Systems running Linux kernels with the gma500 DRM driver and Oaktrail (Intel Atom Oaktrail-era) HDMI output. Systems without this hardware or without the gma500 driver loaded can skip it. The sources do not say which kernel versions are fixed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98886","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98886","severity":null,"published_at":"2026-10-23T12:18:22+00:00","modified_at":"2026-10-23T12:18:22+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98886","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98886","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}