CVE-2026-98623 — drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update If list_for_each_entry() exits wi…
Published: 2026-10-18 · CVSS: Unscored
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update If list_for_each_entry() exits without hitting a break then "pstate" is not a valid pstate pointer. Introduce a "found" variable instead. The check is reachable from userspace: nvkm_clk_ustate_update() takes the pstate id straight from the 'pstate' debugfs file, so requesting an id that is not in clk->states - or any id at all when the perf tables are broken and the list is empty - makes the pstate->pstate != req test dereference the list head cast to a struct nvkm_pstate, which is an out-of-bounds read. [Francesco: rebased on drm-misc-next, expanded the commit message]
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7