SB2026102293 - Incorrect Calculation of Buffer Size in Linux kernel drm nouveau driver

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-98518)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access memory outside the intended VRAM buffer, potentially disclosing information or corrupting memory.

The vulnerability exists due to an incorrect buffer size calculation in the nouveau driver's device-memory allocation code when registering a device-private memory region for GPU memory migration. A local user can exercise affected memory migration paths involving pages beyond the first chunk to cause VRAM accesses outside the backing buffer object.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/06c69c64686a31783c8bec6495dc22822d38c4ce
• https://git.kernel.org/stable/c/64ca4cdd1031206424e6455f0ae4fb0560d8f46a