CVE-2026-98513

Received Received - Intake

Runtime PM Leak in Nouveau Linux Kernel Driver

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() If nvif_outp_edid_get() fails, nouveau_connector_detect() returns early without dropping the runtime PM reference taken at the start of the function, keeping the device powered on until the next successful detect. Balance the reference on the error path like the other exit paths do.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98513

EUVD

EUVD-2026-103753

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	0cd7e07181390085742bf623d6af3eef215c0503
Linux	Linux	0cd7e07181390085742bf623d6af3eef215c0503
Linux	Linux	0cd7e07181390085742bf623d6af3eef215c0503
Linux	Linux	0cd7e07181390085742bf623d6af3eef215c0503
Linux	Linux	6.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's Nouveau driver for NVIDIA GPUs. It involves a runtime power management (PM) leak where the function nouveau_connector_detect() fails to release a PM reference if an error occurs during EDID retrieval. This keeps the GPU powered on unnecessarily until the next successful detection.

Detection Guidance

This vulnerability is specific to the Linux kernel's Nouveau DRM driver and relates to a runtime PM leak. Detection requires checking kernel logs for Nouveau-related errors or examining runtime PM states of GPU devices. Commands like dmesg | grep -i nouveau or cat /sys/kernel/debug/vm/nouveau_pm/state may help identify issues.

Impact Analysis

The impact is limited to increased power consumption of the GPU. It does not cause crashes, data loss, or security breaches. The device remains powered longer than intended, which may reduce battery life on laptops or increase electricity usage on desktops.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a runtime power management leak in the Linux kernel's Nouveau driver, which could lead to unnecessary power consumption but does not involve data exposure or privacy risks.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-98513. This resolves the runtime PM leak in the Nouveau driver's connector detection function.

Hi! I’m here to help you understand CVE-2026-98513. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70