CVE-2026-98623

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update

If list_for_each_entry() exits without hitting a break then "pstate" is

not a valid pstate pointer. Introduce a "found" variable instead.

The check is reachable from userspace: nvkm_clk_ustate_update() takes the

pstate id straight from the 'pstate' debugfs file, so requesting an id

that is not in clk->states - or any id at all when the perf tables are

broken and the list is empty - makes the pstate->pstate != req test

dereference the list head cast to a struct nvkm_pstate, which is an

out-of-bounds read.

[Francesco: rebased on drm-misc-next, expanded the commit message]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References