Vulnerability-Lookup

GHSA-862J-6X74-2P6M

Vulnerability from github – Published: 2026-10-23 15:31 – Updated: 2026-10-23 15:31

Details

In the Linux kernel, the following vulnerability has been resolved:

drm/imagination: Size page table preallocation by device address

Commit 0a8224058a58 ("drm/imagination: Fix page count for page table for map() interface") passed the device address to pvr_mmu_op_context_create(), but the preallocation is still sized from device_addr + sgt_offset with an exclusive end. The offset into the object's pages has no place in a device-virtual range, and the exclusive end allocates one table too many when the range ends on a table boundary.

Count the tables from device_addr and the inclusive end of the range.

The new calculation does not take page table indices into account. This fixes another issue with the previous implementation, where the difference between start and end indices could underflow when a mapping crossed a page table boundary. This would lead to the driver preallocating a huge number of MMU pages, exhausting system memory and triggering an out of memory panic.

[Alessio: add paragraph to point out OOM bug being fixed, cc stable]

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-99004"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-23T13:17:22Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: Size page table preallocation by device address\n\nCommit 0a8224058a58 (\"drm/imagination: Fix page count for page table for\nmap() interface\") passed the device address to\npvr_mmu_op_context_create(), but the preallocation is still sized from\ndevice_addr + sgt_offset with an exclusive end. The offset into the\nobject\u0027s pages has no place in a device-virtual range, and the exclusive\nend allocates one table too many when the range ends on a table\nboundary.\n\nCount the tables from device_addr and the inclusive end of the range.\n\nThe new calculation does not take page table indices into account. This\nfixes another issue with the previous implementation, where the\ndifference between start and end indices could underflow when a mapping\ncrossed a page table boundary. This would lead to the driver\npreallocating a huge number of MMU pages, exhausting system memory and\ntriggering an out of memory panic.\n\n[Alessio: add paragraph to point out OOM bug being fixed, cc stable]",
  "id": "GHSA-862j-6x74-2p6m",
  "modified": "2026-10-23T15:31:34Z",
  "published": "2026-10-23T15:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99004"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/51b56bad96fd20127034f660b337c00317c65151"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/789f290b2e81d42820bddcb4010ffbc2ae2ded54"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7f73da0facf864fe796371ebaccacb1fee678aaf"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f9b215b3e37a5047c406545de51bf8a2aeb4cd1c"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2026-99004 (GCVE-0-2026-99004)

Vulnerability from cvelistv5 – Published: 2026-10-23 12:20 – Updated: 2026-10-23 12:20

Title

drm/imagination: Size page table preallocation by device address

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 ("drm/imagination: Fix page count for page table for map() interface") passed the device address to pvr_mmu_op_context_create(), but the preallocation is still sized from device_addr + sgt_offset with an exclusive end. The offset into the object's pages has no place in a device-virtual range, and the exclusive end allocates one table too many when the range ends on a table boundary. Count the tables from device_addr and the inclusive end of the range. The new calculation does not take page table indices into account. This fixes another issue with the previous implementation, where the difference between start and end indices could underflow when a mapping crossed a page table boundary. This would lead to the driver preallocating a huge number of MMU pages, exhausting system memory and triggering an out of memory panic. [Alessio: add paragraph to point out OOM bug being fixed, cc stable]

Severity

No CVSS data available.

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7056 records in the last 180 days details

References

4 references

URL	Tags
https://git.kernel.org/stable/c/51b56bad96fd20127…
https://git.kernel.org/stable/c/f9b215b3e37a5047c…
https://git.kernel.org/stable/c/7f73da0facf864fe7…
https://git.kernel.org/stable/c/789f290b2e81d4282…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: ff5f643de0bf27874c4033cd57a0bd034b5c7d11 , < 51b56bad96fd20127034f660b337c00317c65151 (git) Affected: ff5f643de0bf27874c4033cd57a0bd034b5c7d11 , < f9b215b3e37a5047c406545de51bf8a2aeb4cd1c (git) Affected: ff5f643de0bf27874c4033cd57a0bd034b5c7d11 , < 7f73da0facf864fe796371ebaccacb1fee678aaf (git) Affected: ff5f643de0bf27874c4033cd57a0bd034b5c7d11 , < 789f290b2e81d42820bddcb4010ffbc2ae2ded54 (git)
Linux	Linux	Affected: 6.8 Unaffected: 0 , < 6.8 (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/imagination/pvr_mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "51b56bad96fd20127034f660b337c00317c65151",
              "status": "affected",
              "version": "ff5f643de0bf27874c4033cd57a0bd034b5c7d11",
              "versionType": "git"
            },
            {
              "lessThan": "f9b215b3e37a5047c406545de51bf8a2aeb4cd1c",
              "status": "affected",
              "version": "ff5f643de0bf27874c4033cd57a0bd034b5c7d11",
              "versionType": "git"
            },
            {
              "lessThan": "7f73da0facf864fe796371ebaccacb1fee678aaf",
              "status": "affected",
              "version": "ff5f643de0bf27874c4033cd57a0bd034b5c7d11",
              "versionType": "git"
            },
            {
              "lessThan": "789f290b2e81d42820bddcb4010ffbc2ae2ded54",
              "status": "affected",
              "version": "ff5f643de0bf27874c4033cd57a0bd034b5c7d11",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/imagination/pvr_mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.113",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: Size page table preallocation by device address\n\nCommit 0a8224058a58 (\"drm/imagination: Fix page count for page table for\nmap() interface\") passed the device address to\npvr_mmu_op_context_create(), but the preallocation is still sized from\ndevice_addr + sgt_offset with an exclusive end. The offset into the\nobject\u0027s pages has no place in a device-virtual range, and the exclusive\nend allocates one table too many when the range ends on a table\nboundary.\n\nCount the tables from device_addr and the inclusive end of the range.\n\nThe new calculation does not take page table indices into account. This\nfixes another issue with the previous implementation, where the\ndifference between start and end indices could underflow when a mapping\ncrossed a page table boundary. This would lead to the driver\npreallocating a huge number of MMU pages, exhausting system memory and\ntriggering an out of memory panic.\n\n[Alessio: add paragraph to point out OOM bug being fixed, cc stable]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-23T12:20:29.122Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/51b56bad96fd20127034f660b337c00317c65151"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9b215b3e37a5047c406545de51bf8a2aeb4cd1c"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f73da0facf864fe796371ebaccacb1fee678aaf"
        },
        {
          "url": "https://git.kernel.org/stable/c/789f290b2e81d42820bddcb4010ffbc2ae2ded54"
        }
      ],
      "title": "drm/imagination: Size page table preallocation by device address",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99004",
    "datePublished": "2026-10-23T12:20:29.122Z",
    "dateReserved": "2026-09-25T10:25:14.385Z",
    "dateUpdated": "2026-10-23T12:20:29.122Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted