Out-of-bounds read in Linux kernel - CVE-2026-98298
Published: October 7, 2026
Vulnerability identifier: #VU153725
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98298
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause out-of-bounds reads and silent data loss.
The vulnerability exists due to incorrect scatterlist entry length selection in mmp_pdma_prep_slave_sg() when preparing DMA transfers from scatterlists containing entries of different lengths. A local user can trigger processing of such a scatterlist to cause out-of-bounds reads and silent data loss.
Affected software
Linux kernel
How to mitigate CVE-2026-98298
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/075bc7b1d3dde5ed43fbaabbc1a69f09b7fc3a47
- https://git.kernel.org/stable/c/2148db529f082d6e3ca95413bf943442f4ef30cc
- https://git.kernel.org/stable/c/4a33886057e6d127555efb022879c583e966acc5
- https://git.kernel.org/stable/c/54ccc01012a240476edf641bf1a2b8bff54fe6ae
- https://git.kernel.org/stable/c/88a505330eb06128f7ce79a4c5e4832b7601b3d1
- https://git.kernel.org/stable/c/bae65e4925928f77824ca0103122e2ed20ef5802
- https://git.kernel.org/stable/c/d920c07aa6d89ec11afdb6976aafaee9563a5234
- https://git.kernel.org/stable/c/f448a5f5bd10d792440a1b08cf2e8f311767032d