Incorrect Calculation of Buffer Size in Linux kernel - CVE-2026-98518

Vulnerability identifier: #VU156819

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98518

CWE-ID: CWE-131

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to access memory outside the intended VRAM buffer, potentially disclosing information or corrupting memory.

The vulnerability exists due to an incorrect buffer size calculation in the nouveau driver's device-memory allocation code when registering a device-private memory region for GPU memory migration. A local user can exercise affected memory migration paths involving pages beyond the first chunk to cause VRAM accesses outside the backing buffer object.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/06c69c64686a31783c8bec6495dc22822d38c4ce
• https://git.kernel.org/stable/c/64ca4cdd1031206424e6455f0ae4fb0560d8f46a

• Incorrect Calculation of Buffer Size in Linux kernel drm nouveau driver
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more