https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 03 Nov 2026 08:13:55 +0000 https://db.gcve.eu/vuln/cve-2026-98623 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update</p> <p>If list_for_each_entry() exits without hitting a break then &#34;pstate&#34; is not a valid pstate pointer. Introduce a &#34;found&#34; variable instead.</p> <p>The check is reachable from userspace: nvkm_clk_ustate_update() takes the pstate id straight from the &#39;pstate&#39; debugfs file, so requesting an id that is not in clk-&gt;states - or any id at all when the perf tables are broken and the list is empty - makes the pstate-&gt;pstate != req test dereference the list head cast to a struct nvkm_pstate, which is an out-of-bounds read.</p> <p>[Francesco: rebased on drm-misc-next, expanded the commit message]</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update</p> <p>If list_for_each_entry() exits without hitting a break then &#34;pstate&#34; is not a valid pstate pointer. Introduce a &#34;found&#34; variable instead.</p> <p>The check is reachable from userspace: nvkm_clk_ustate_update() takes the pstate id straight from the &#39;pstate&#39; debugfs file, so requesting an id that is not in clk-&gt;states - or any id at all when the perf tables are broken and the list is empty - makes the pstate-&gt;pstate != req test dereference the list head cast to a struct nvkm_pstate, which is an out-of-bounds read.</p> <p>[Francesco: rebased on drm-misc-next, expanded the commit message]</p> https://db.gcve.eu/vuln/cve-2026-98623