Cloudanix VulnDB

CVE-2026-98566

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A recently fixed Linux graphics driver bug could let faulty hardware communication cause system crashes or memory problems on machines with certain Imagination GPUs.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Privilege Gain
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing bounds check on firmware-provided reconstruction count allows out-of-bounds memory accesses into fixed-size freelist ID and response arrays in the Imagination DRM driver.

Why it matters to the business

Graphics subsystems on affected Linux systems risk kernel instability or memory corruption during firmware recovery, potentially causing application crashes or system reboots; low immediate risk given recent disclosure and minimal EPSS.

How an attack unfolds

An attacker capable of influencing Imagination GPU firmware behavior supplies an oversized reconstruction count during the firmware recovery exchange; the driver then uses this count without clamping to access and copy into fixed protocol arrays, resulting in invalid memory operations.

How to fix it

Update the Linux kernel to a version containing the clamp on reconstruction count and consistent use of that count for both reconstruction and response handling; retain the firmware recovery exchange as implemented in the fix.

How to confirm the fix worked

Confirm the presence of the bounds clamp on the firmware reconstruction count before array accesses and verify consistent count usage for response publication in the drm/imagination driver source or running kernel binary.

Typical attack path

  1. Gain control or simulate malicious Imagination GPU firmware responses
  2. Trigger firmware reconstruction request with count exceeding protocol array sizes
  3. Driver performs unbounded accesses during freelist reconstruction and response publication
  4. Induce kernel memory corruption or crash

How to detect it

Search kernel logs for Imagination DRM driver oops or panic entries around firmware reconstruction paths; examine crash dumps for array index or memory access violations tied to freelist handling.

What your security team should do

  • Prioritize kernel updates for systems exposing Imagination GPUs within the next maintenance window
  • Monitor graphics driver stability metrics for unexpected crashes post-publication
  • Review downstream kernel distributions for backported patches given the five-day disclosure window

The record

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: clamp freelist reconstruction requests The firmware reconstruction count controls accesses to the request's fixed freelist ID array and the copy into the fixed response array. Neither access currently bounds the count to those protocol arrays. Clamp the count to the request capacity, which is shared by the response layout, and use that count consistently for reconstruction and response publication. Keep the firmware recovery exchange instead of dropping an oversized request without a response, as discussed with the firmware maintainer. The issue was found by our static-analysis tool.

Affected packages

Ecosystem Package Introduced Fixed