{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-98142",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2026-09-25T10:25:14.319Z",
        "datePublished": "2026-09-25T10:36:17.832Z",
        "dateUpdated": "2026-10-19T09:14:35.740Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-10-19T09:14:35.740Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/cirrus-qemu: Validate BAR0 size during probe\n\nThe `cirrus-qemu` driver relies on `CIRRUS_VRAM_SIZE` (4 MB) to validate\nframebuffer sizes. However, during PCI probe, the driver mapped BAR0\nwithout verifying that its size matches `CIRRUS_VRAM_SIZE`.\n\nIf a PCI device with a BAR0 smaller than 4 MB is bound to the driver, the\nmapped VRAM will be smaller than expected. Because validation checks assume\n4 MB VRAM, framebuffers larger than the mapped memory can be created.\n\nWhen the display plane is updated (e.g. during release),\n`cirrus_primary_plane_helper_atomic_update()` copies the framebuffer to\nVRAM using `drm_fb_memcpy()`. Writing past the end of the mapped I/O memory\ncauses a supervisor write page fault:\n\nBUG: unable to handle page fault for address: ffffc9000389c000\n...\nRIP: 0010:memcpy_toio+0x7c/0xe0 arch/x86/lib/iomem.c:110\n...\nCall Trace:\n <TASK>\n iosys_map_memcpy_to include/linux/iosys-map.h:285 [inline]\n drm_fb_memcpy+0x325/0x5d0 drivers/gpu/drm/drm_format_helper.c:442\n cirrus_primary_plane_helper_atomic_update+0x98a/0xb00\n drivers/gpu/drm/tiny/cirrus-qemu.c:358\n drm_atomic_helper_commit_planes+0x626/0xea0\n drivers/gpu/drm/drm_atomic_helper.c:3038\n drm_atomic_helper_commit_tail+0x60/0x510\n drivers/gpu/drm/drm_atomic_helper.c:1989\n commit_tail+0x2b1/0x3c0 drivers/gpu/drm/drm_atomic_helper.c:2074\n drm_atomic_helper_commit+0xa77/0xb10\n drivers/gpu/drm/drm_atomic_helper.c:2312\n\nFix this by validating in `cirrus_pci_probe()` that the PCI BAR0 resource\nis not less than `CIRRUS_VRAM_SIZE`, returning `-ENODEV` if it is less."
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/gpu/drm/tiny/cirrus-qemu.c"
                    ],
                    "versions": [
                        {
                            "version": "ab3e023b1b4c9887c9f0f761b47f3f0516bd3434",
                            "lessThan": "2a0e7bcff3fa63e7309d2b39e18af59eb8ef2b6e",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "ab3e023b1b4c9887c9f0f761b47f3f0516bd3434",
                            "lessThan": "0b5084a1f070ad1fc34e11945644ae034bbc774c",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "ab3e023b1b4c9887c9f0f761b47f3f0516bd3434",
                            "lessThan": "26bd90c886218f36c9adeab206b0e27b4384e2f6",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "ab3e023b1b4c9887c9f0f761b47f3f0516bd3434",
                            "lessThan": "144f51cd0ccc3ad47a6099917b7bb535611fb18f",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "ab3e023b1b4c9887c9f0f761b47f3f0516bd3434",
                            "lessThan": "92312d333bf700798f92f30406c721bce87506f3",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/gpu/drm/tiny/cirrus-qemu.c"
                    ],
                    "versions": [
                        {
                            "version": "5.2",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "5.2",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.6.158",
                            "lessThanOrEqual": "6.6.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.12.111",
                            "lessThanOrEqual": "6.12.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.18.53",
                            "lessThanOrEqual": "6.18.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.2.7",
                            "lessThanOrEqual": "7.2.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.3",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.2",
                                    "versionEndExcluding": "6.6.158"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.2",
                                    "versionEndExcluding": "6.12.111"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.2",
                                    "versionEndExcluding": "6.18.53"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.2",
                                    "versionEndExcluding": "7.2.7"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.2",
                                    "versionEndExcluding": "7.3"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/2a0e7bcff3fa63e7309d2b39e18af59eb8ef2b6e"
                },
                {
                    "url": "https://git.kernel.org/stable/c/0b5084a1f070ad1fc34e11945644ae034bbc774c"
                },
                {
                    "url": "https://git.kernel.org/stable/c/26bd90c886218f36c9adeab206b0e27b4384e2f6"
                },
                {
                    "url": "https://git.kernel.org/stable/c/144f51cd0ccc3ad47a6099917b7bb535611fb18f"
                },
                {
                    "url": "https://git.kernel.org/stable/c/92312d333bf700798f92f30406c721bce87506f3"
                }
            ],
            "title": "drm/cirrus-qemu: Validate BAR0 size during probe",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}