Cloudanix VulnDB

CVE-2026-98142

None

CVSS

—

EPSS

0.2%

Published

Sep 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem in Linux graphics hardware handling can let the system crash when certain virtual display devices are used.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Failure to validate PCI BAR0 size in cirrus-qemu driver allows framebuffers larger than mapped VRAM, resulting in out-of-bounds writes via drm_fb_memcpy during plane updates and supervisor page faults.

Why it matters to the business

Risk of kernel crashes and denial of service on systems using the cirrus-qemu DRM driver; low exploitation likelihood given EPSS of 0.00156 with no trend and absence from KEV after 28 days since publication.

How an attack unfolds

An attacker presents a PCI device claiming a BAR0 smaller than 4 MB to the cirrus-qemu driver during probe; once bound, creation of oversized framebuffers followed by display updates triggers memcpy past the mapped I/O region, causing page faults.

How to fix it

Update the Linux kernel to a version containing the cirrus_pci_probe validation that returns -ENODEV for BAR0 resources smaller than CIRRUS_VRAM_SIZE.

How to confirm the fix worked

Inspect kernel source for the added size check in cirrus_pci_probe; verify that binding a non-conforming PCI device now fails with -ENODEV and does not proceed to framebuffer operations.

Typical attack path

  1. Supply a PCI device with undersized BAR0 to the target system
  2. Ensure the cirrus-qemu driver binds to the device during PCI probe
  3. Trigger framebuffer creation and atomic plane update operations
  4. Induce out-of-bounds write during drm_fb_memcpy leading to kernel fault

How to detect it

Search kernel logs and crash dumps for call traces containing cirrus_primary_plane_helper_atomic_update, drm_fb_memcpy, memcpy_toio, and page fault addresses in the cirrus VRAM mapping region.

What your security team should do

  • Prioritize kernel updates for systems exposing the cirrus-qemu driver
  • Audit virtualization or emulation setups that may present arbitrary PCI BAR configurations
  • Monitor for related kernel oops reports while planning rollout

The record

In the Linux kernel, the following vulnerability has been resolved: drm/cirrus-qemu: Validate BAR0 size during probe The `cirrus-qemu` driver relies on `CIRRUS_VRAM_SIZE` (4 MB) to validate framebuffer sizes. However, during PCI probe, the driver mapped BAR0 without verifying that its size matches `CIRRUS_VRAM_SIZE`. If a PCI device with a BAR0 smaller than 4 MB is bound to the driver, the mapped VRAM will be smaller than expected. Because validation checks assume 4 MB VRAM, framebuffers larger than the mapped memory can be created. When the display plane is updated (e.g. during release), `cirrus_primary_plane_helper_atomic_update()` copies the framebuffer to VRAM using `drm_fb_memcpy()`. Writing past the end of the mapped I/O memory causes a supervisor write page fault: BUG: unable to handle page fault for address: ffffc9000389c000 ... RIP: 0010:memcpy_toio+0x7c/0xe0 arch/x86/lib/iomem.c:110 ... Call Trace: <TASK> iosys_map_memcpy_to include/linux/iosys-map.h:285 [inline] drm_fb_memcpy+0x325/0x5d0 drivers/gpu/drm/drm_format_helper.c:442 cirrus_primary_plane_helper_atomic_update+0x98a/0xb00 drivers/gpu/drm/tiny/cirrus-qemu.c:358 drm_atomic_helper_commit_planes+0x626/0xea0 drivers/gpu/drm/drm_atomic_helper.c:3038 drm_atomic_helper_commit_tail+0x60/0x510 drivers/gpu/drm/drm_atomic_helper.c:1989 commit_tail+0x2b1/0x3c0 drivers/gpu/drm/drm_atomic_helper.c:2074 drm_atomic_helper_commit+0xa77/0xb10 drivers/gpu/drm/drm_atomic_helper.c:2312 Fix this by validating in `cirrus_pci_probe()` that the PCI BAR0 resource is not less than `CIRRUS_VRAM_SIZE`, returning `-ENODEV` if it is less.

Affected packages

Ecosystem Package Introduced Fixed