CVE-2026-98142

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/cirrus-qemu: Validate BAR0 size during probe

The `cirrus-qemu` driver relies on `CIRRUS_VRAM_SIZE` (4 MB) to validate

framebuffer sizes. However, during PCI probe, the driver mapped BAR0

without verifying that its size matches `CIRRUS_VRAM_SIZE`.

If a PCI device with a BAR0 smaller than 4 MB is bound to the driver, the

mapped VRAM will be smaller than expected. Because validation checks assume

4 MB VRAM, framebuffers larger than the mapped memory can be created.

When the display plane is updated (e.g. during release),

`cirrus_primary_plane_helper_atomic_update()` copies the framebuffer to

VRAM using `drm_fb_memcpy()`. Writing past the end of the mapped I/O memory

causes a supervisor write page fault:

BUG: unable to handle page fault for address: ffffc9000389c000

...

RIP: 0010:memcpy_toio+0x7c/0xe0 arch/x86/lib/iomem.c:110

...

Call Trace:

<TASK>

iosys_map_memcpy_to include/linux/iosys-map.h:285 [inline]

drm_

/// Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References