{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98518", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.354Z", "datePublished": "2026-10-18T15:17:36.371Z", "dateUpdated": "2026-10-19T09:20:59.258Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:20:59.258Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/dmem: pin VRAM for the whole registered range\n\nCommit c32287471077 (\"gpu/drm/nouveau: enable THP support for GPU memory\nmigration\") grew the device-private region that\nnouveau_dmem_chunk_alloc() registers from DMEM_CHUNK_SIZE to\nDMEM_CHUNK_SIZE * NR_CHUNKS, but left the VRAM buffer object backing that\nregion at DMEM_CHUNK_SIZE.\n\nnouveau_dmem_page_addr() returns chunk->bo->offset plus the page's offset\nwithin the registered region, so every page past the first chunk resolves\nto VRAM outside the buffer object.\n\nSize the buffer object to the region it backs."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/nouveau/nouveau_dmem.c"], "versions": [{"version": "c3228747107705d47c7e9a03598a434a0380cb73", "lessThan": "06c69c64686a31783c8bec6495dc22822d38c4ce", "status": "affected", "versionType": "git"}, {"version": "c3228747107705d47c7e9a03598a434a0380cb73", "lessThan": "64ca4cdd1031206424e6455f0ae4fb0560d8f46a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/nouveau/nouveau_dmem.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/06c69c64686a31783c8bec6495dc22822d38c4ce"}, {"url": "https://git.kernel.org/stable/c/64ca4cdd1031206424e6455f0ae4fb0560d8f46a"}], "title": "drm/nouveau/dmem: pin VRAM for the whole registered range", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/nouveau/nouveau_dmem.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "06c69c64686a31783c8bec6495dc22822d38c4ce", "status": "affected", "version": "c3228747107705d47c7e9a03598a434a0380cb73", "versionType": "git"}, {"lessThan": "64ca4cdd1031206424e6455f0ae4fb0560d8f46a", "status": "affected", "version": "c3228747107705d47c7e9a03598a434a0380cb73", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/nouveau/nouveau_dmem.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/dmem: pin VRAM for the whole registered range\n\nCommit c32287471077 (\"gpu/drm/nouveau: enable THP support for GPU memory\nmigration\") grew the device-private region that\nnouveau_dmem_chunk_alloc() registers from DMEM_CHUNK_SIZE to\nDMEM_CHUNK_SIZE * NR_CHUNKS, but left the VRAM buffer object backing that\nregion at DMEM_CHUNK_SIZE.\n\nnouveau_dmem_page_addr() returns chunk->bo->offset plus the page's offset\nwithin the registered region, so every page past the first chunk resolves\nto VRAM outside the buffer object.\n\nSize the buffer object to the region it backs."}], "id": "CVE-2026-98518", "lastModified": "2026-10-19T10:19:05.660", "metrics": {}, "published": "2026-10-18T16:17:03.163", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/06c69c64686a31783c8bec6495dc22822d38c4ce"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/64ca4cdd1031206424e6455f0ae4fb0560d8f46a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/nouveau/dmem: pin VRAM for the whole registered range", "id": "2554887", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554887"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/nouveau/dmem: pin VRAM for the whole registered range\nCommit c32287471077 (\"gpu/drm/nouveau: enable THP support for GPU memory\nmigration\") grew the device-private region that\nnouveau_dmem_chunk_alloc() registers from DMEM_CHUNK_SIZE to\nDMEM_CHUNK_SIZE * NR_CHUNKS, but left the VRAM buffer object backing that\nregion at DMEM_CHUNK_SIZE.\nnouveau_dmem_page_addr() returns chunk->bo->offset plus the page's offset\nwithin the registered region, so every page past the first chunk resolves\nto VRAM outside the buffer object.\nSize the buffer object to the region it backs.", "A flaw was found in the Linux kernel's Nouveau graphics driver. This vulnerability allows a local user to cause a denial of service (DoS) or system instability through an out-of-bounds memory access in video random-access memory (VRAM). The issue occurs because the driver fails to allocate an adequately sized buffer object to back the full registered device memory range. As a result, memory requests referencing pages past the initial chunk access memory outside the buffer boundaries."], "name": "CVE-2026-98518", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98518\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98518\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98518.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c3228747107705d47c7e9a03598a434a0380cb73,06c69c64686a31783c8bec6495dc22822d38c4ce)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c3228747107705d47c7e9a03598a434a0380cb73,64ca4cdd1031206424e6455f0ae4fb0560d8f46a)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T17:45:06.374213+00:00", "title": "Kernel Nouveau Driver Buffer Allocation Miscalculation", "updated": "2026-10-19T02:15:14.259715+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-119"]}