Cloudanix VulnDB

CVE-2026-98886

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in certain Linux graphics hardware handling could let the system freeze when reading display settings, and the fix stops the freeze by properly handling delays.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

The gma500 Oaktrail HDMI I2C driver xfer_read function ignores timeout and signal returns from wait_for_completion_interruptible_timeout, allowing an uncompleted transaction to cause an unbounded wait and potential kernel hang.

Why it matters to the business

Systems using the affected driver may experience unresponsiveness or denial of service on HDMI-related I2C operations, disrupting graphics or display functionality with low but non-zero exploit probability.

How an attack unfolds

An attacker triggers repeated or malformed I2C reads on the Oaktrail HDMI interface so that the completion signal never arrives; the ignored return values leave the calling thread blocked indefinitely, achieving local denial of service.

How to fix it

Apply the upstream kernel patch that returns -ETIMEDOUT on wait expiration, propagates interrupted waits, and ensures master_xfer returns the first error instead of a success count; rebuild and deploy the updated kernel.

How to confirm the fix worked

Confirm the fix is present by inspecting the drm/gma500 I2C code for proper handling of wait_for_completion_interruptible_timeout return values and updated master_xfer error propagation; test I2C read paths under simulated timeout conditions.

Typical attack path

  1. Obtain local access or execute code on a system with the gma500 driver loaded
  2. Trigger HDMI I2C transactions via graphics or display APIs
  3. Supply input that prevents the hardware interrupt from completing the transaction
  4. Observe or force repeated waits that exhaust scheduling resources

How to detect it

Review kernel logs for repeated or stalled I2C transactions involving gma500 or Oaktrail HDMI; look for processes blocked in drm or i2c subsystems without corresponding hardware interrupts completing.

What your security team should do

  • Prioritize kernel update on any systems exposing the gma500 driver within the next patch cycle
  • Monitor upstream stable branches for the merged commit
  • Limit untrusted local code execution on affected hardware until patched

The record

In the Linux kernel, the following vulnerability has been resolved: drm/gma500: return errors from Oaktrail HDMI I2C reads xfer_read() waits for the HDMI I2C transaction to reach I2C_TRANSACTION_DONE, but it ignores both timeout and signal returns from wait_for_completion_interruptible_timeout(). If the interrupt never advances the transaction state, the loop can wait forever. Return -ETIMEDOUT when the completion wait expires, propagate interrupted waits, and make the I2C master_xfer callback return the first transfer error instead of reporting a successful message count.

Affected packages

Ecosystem Package Introduced Fixed