https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 03 Nov 2026 23:01:00 +0000 https://db.gcve.eu/vuln/certfr-2026-avi-1375 certfr-2026-avi-1375 https://db.gcve.eu/vuln/certfr-2026-avi-1375 https://db.gcve.eu/vuln/fkie_cve-2026-98623 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update</p> <p>If list_for_each_entry() exits without hitting a break then &#34;pstate&#34; is not a valid pstate pointer. Introduce a &#34;found&#34; variable instead.</p> <p>The check is reachable from userspace: nvkm_clk_ustate_update() takes the pstate id straight from the &#39;pstate&#39; debugfs file, so requesting an id that is not in clk-&gt;states - or any id at all when the perf tables are broken and the list is empty - makes the pstate-&gt;pstate != req test dereference the list head cast to a struct nvkm_pstate, which is an out-of-bounds read.</p> <p>[Francesco: rebased on drm-misc-next, expanded the commit message]</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update</p> <p>If list_for_each_entry() exits without hitting a break then &#34;pstate&#34; is not a valid pstate pointer. Introduce a &#34;found&#34; variable instead.</p> <p>The check is reachable from userspace: nvkm_clk_ustate_update() takes the pstate id straight from the &#39;pstate&#39; debugfs file, so requesting an id that is not in clk-&gt;states - or any id at all when the perf tables are broken and the list is empty - makes the pstate-&gt;pstate != req test dereference the list head cast to a struct nvkm_pstate, which is an out-of-bounds read.</p> <p>[Francesco: rebased on drm-misc-next, expanded the commit message]</p> https://db.gcve.eu/vuln/fkie_cve-2026-98623 https://db.gcve.eu/vuln/ghsa-5c9q-m24x-7r34 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update</p> <p>If list_for_each_entry() exits without hitting a break then &#34;pstate&#34; is not a valid pstate pointer. Introduce a &#34;found&#34; variable instead.</p> <p>The check is reachable from userspace: nvkm_clk_ustate_update() takes the pstate id straight from the &#39;pstate&#39; debugfs file, so requesting an id that is not in clk-&gt;states - or any id at all when the perf tables are broken and the list is empty - makes the pstate-&gt;pstate != req test dereference the list head cast to a struct nvkm_pstate, which is an out-of-bounds read.</p> <p>[Francesco: rebased on drm-misc-next, expanded the commit message]</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update</p> <p>If list_for_each_entry() exits without hitting a break then &#34;pstate&#34; is not a valid pstate pointer. Introduce a &#34;found&#34; variable instead.</p> <p>The check is reachable from userspace: nvkm_clk_ustate_update() takes the pstate id straight from the &#39;pstate&#39; debugfs file, so requesting an id that is not in clk-&gt;states - or any id at all when the perf tables are broken and the list is empty - makes the pstate-&gt;pstate != req test dereference the list head cast to a struct nvkm_pstate, which is an out-of-bounds read.</p> <p>[Francesco: rebased on drm-misc-next, expanded the commit message]</p> https://db.gcve.eu/vuln/ghsa-5c9q-m24x-7r34 https://db.gcve.eu/vuln/msrc_cve-2026-98623 msrc_CVE-2026-98623 https://db.gcve.eu/vuln/msrc_cve-2026-98623 https://db.gcve.eu/vuln/ubuntu-cve-2026-98623 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 247 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update If list_for_each_entry() exits without hitting a break then &#34;pstate&#34; is not a valid pstate pointer. Introduce a &#34;found&#34; variable instead. The check is reachable from userspace: nvkm_clk_ustate_update() takes the pstate id straight from the &#39;pstate&#39; debugfs file, so requesting an id that is not in clk-&gt;states - or any id at all when the perf tables are broken and the list is empty - makes the pstate-&gt;pstate != req test dereference the list head cast to a struct nvkm_pstate, which is an out-of-bounds read. [Francesco: rebased on drm-misc-next, expanded the commit message]</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 247 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update If list_for_each_entry() exits without hitting a break then &#34;pstate&#34; is not a valid pstate pointer. Introduce a &#34;found&#34; variable instead. The check is reachable from userspace: nvkm_clk_ustate_update() takes the pstate id straight from the &#39;pstate&#39; debugfs file, so requesting an id that is not in clk-&gt;states - or any id at all when the perf tables are broken and the list is empty - makes the pstate-&gt;pstate != req test dereference the list head cast to a struct nvkm_pstate, which is an out-of-bounds read. [Francesco: rebased on drm-misc-next, expanded the commit message]</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-98623 https://db.gcve.eu/vuln/wid-sec-w-2026-4019 <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, möglicherweise einen Denial-of-Service-Angriff auszulösen, Daten zu manipulieren oder offenzulegen oder Sicherheitsmaßnahmen zu umgehen.</p> <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, möglicherweise einen Denial-of-Service-Angriff auszulösen, Daten zu manipulieren oder offenzulegen oder Sicherheitsmaßnahmen zu umgehen.</p> https://db.gcve.eu/vuln/wid-sec-w-2026-4019