CVE-2026-98566 (GCVE-0-2026-98566)
Vulnerability from cvelistv5
Published
2026-10-18 15:18
Modified
2026-10-19 09:21
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/imagination: clamp freelist reconstruction requests The firmware reconstruction count controls accesses to the request's fixed freelist ID array and the copy into the fixed response array. Neither access currently bounds the count to those protocol arrays. Clamp the count to the request capacity, which is shared by the response layout, and use that count consistently for reconstruction and response publication. Keep the firmware recovery exchange instead of dropping an oversized request without a response, as discussed with the firmware maintainer. The issue was found by our static-analysis tool.
References
Impacted products
Vendor Product Version
Linux Linux Version: 6eedddab733b350886571f98b810108b13bf74ae
Version: 6eedddab733b350886571f98b810108b13bf74ae
Version: 6eedddab733b350886571f98b810108b13bf74ae
Version: 6eedddab733b350886571f98b810108b13bf74ae
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/imagination/pvr_free_list.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b78f8f5532a077baa4aabccf657a4fb3b164659e",
              "status": "affected",
              "version": "6eedddab733b350886571f98b810108b13bf74ae",
              "versionType": "git"
            },
            {
              "lessThan": "e0560db0ea6e10c283ebe7c259a7af8d3b6e61a6",
              "status": "affected",
              "version": "6eedddab733b350886571f98b810108b13bf74ae",
              "versionType": "git"
            },
            {
              "lessThan": "eabd0ae3611769c826dbc118a1e240628731b348",
              "status": "affected",
              "version": "6eedddab733b350886571f98b810108b13bf74ae",
              "versionType": "git"
            },
            {
              "lessThan": "45585c3aa285854face65293acc95eff73063d6d",
              "status": "affected",
              "version": "6eedddab733b350886571f98b810108b13bf74ae",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/imagination/pvr_free_list.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.55",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.9",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: clamp freelist reconstruction requests\n\nThe firmware reconstruction count controls accesses to the request\u0027s\nfixed freelist ID array and the copy into the fixed response array.\nNeither access currently bounds the count to those protocol arrays.\n\nClamp the count to the request capacity, which is shared by the response\nlayout, and use that count consistently for reconstruction and response\npublication. Keep the firmware recovery exchange instead of dropping an\noversized request without a response, as discussed with the firmware\nmaintainer.\n\nThe issue was found by our static-analysis tool."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:21:51.721Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b78f8f5532a077baa4aabccf657a4fb3b164659e"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0560db0ea6e10c283ebe7c259a7af8d3b6e61a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/eabd0ae3611769c826dbc118a1e240628731b348"
        },
        {
          "url": "https://git.kernel.org/stable/c/45585c3aa285854face65293acc95eff73063d6d"
        }
      ],
      "title": "drm/imagination: clamp freelist reconstruction requests",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98566",
    "datePublished": "2026-10-18T15:18:32.679Z",
    "dateReserved": "2026-09-25T10:25:14.357Z",
    "dateUpdated": "2026-10-19T09:21:51.721Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.