Out-of-bounds write in Linux kernel - CVE-2026-98199
Published: October 7, 2026
Vulnerability identifier: #VU153820
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98199
CWE-ID: CWE-787
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to corrupt kernel memory.
The vulnerability exists due to out-of-bounds writes in the PMBus core when probing chips with more than 10 phases per page. A local user can trigger probing of an affected chip to corrupt kernel memory.
The mp2975 driver supports up to 14 phases per page, and the mp2856 driver supports up to 12 phases per page.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98199
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1
External References
- https://git.kernel.org/stable/c/06bd6794b5fd2163880ac3bfe973d4cc61f359f3
- https://git.kernel.org/stable/c/1ec644c94466834f8cb6b7ba12636fd047bdfdda
- https://git.kernel.org/stable/c/272006a52cbd9c8342cead4d3eb9221ebbe8b985
- https://git.kernel.org/stable/c/66368f682a53f3a3842e20eebb571a59809c52c0
- https://git.kernel.org/stable/c/9558fc1e042ac6b12dd63c37d2c51be4ec86d402
- https://git.kernel.org/stable/c/b32607710a20ad983f9fe4a3051892584c0641a4
- https://git.kernel.org/stable/c/b49f100a15b8876deccf8c59f41af92b8e25fd74