CVE-2026-98142
Received Received - Intake

Buffer Overflow in Cirrus QEMU Driver

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/cirrus-qemu: Validate BAR0 size during probe The `cirrus-qemu` driver relies on `CIRRUS_VRAM_SIZE` (4 MB) to validate framebuffer sizes. However, during PCI probe, the driver mapped BAR0 without verifying that its size matches `CIRRUS_VRAM_SIZE`. If a PCI device with a BAR0 smaller than 4 MB is bound to the driver, the mapped VRAM will be smaller than expected. Because validation checks assume 4 MB VRAM, framebuffers larger than the mapped memory can be created. When the display plane is updated (e.g. during release), `cirrus_primary_plane_helper_atomic_update()` copies the framebuffer to VRAM using `drm_fb_memcpy()`. Writing past the end of the mapped I/O memory causes a supervisor write page fault: BUG: unable to handle page fault for address: ffffc9000389c000 ... RIP: 0010:memcpy_toio+0x7c/0xe0 arch/x86/lib/iomem.c:110 ... Call Trace: <TASK> iosys_map_memcpy_to include/linux/iosys-map.h:285 [inline] drm_fb_memcpy+0x325/0x5d0 drivers/gpu/drm/drm_format_helper.c:442 cirrus_primary_plane_helper_atomic_update+0x98a/0xb00 drivers/gpu/drm/tiny/cirrus-qemu.c:358 drm_atomic_helper_commit_planes+0x626/0xea0 drivers/gpu/drm/drm_atomic_helper.c:3038 drm_atomic_helper_commit_tail+0x60/0x510 drivers/gpu/drm/drm_atomic_helper.c:1989 commit_tail+0x2b1/0x3c0 drivers/gpu/drm/drm_atomic_helper.c:2074 drm_atomic_helper_commit+0xa77/0xb10 drivers/gpu/drm/drm_atomic_helper.c:2312 Fix this by validating in `cirrus_pci_probe()` that the PCI BAR0 resource is not less than `CIRRUS_VRAM_SIZE`, returning `-ENODEV` if it is less.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98142
EUVD
EUVD-2026-86973

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the cirrus-qemu driver where BAR0 size is not validated during PCI probe. The driver assumes a fixed 4 MB framebuffer size but fails to check if the actual PCI BAR0 resource matches this size. This can lead to writing framebuffer data beyond the mapped memory, causing a supervisor write page fault.

Detection Guidance

This vulnerability is specific to the Linux kernel's drm/cirrus-qemu driver and requires checking if the cirrus-qemu driver is loaded and if a vulnerable PCI device is present. Check if the driver is loaded with lsmod | grep cirrus. Inspect PCI devices with lspci -v to see if any have a BAR0 smaller than 4 MB. Kernel logs may show page faults if the issue is triggered.

Impact Analysis

If exploited, this vulnerability can cause system crashes due to page faults when the display plane updates. It may also lead to memory corruption or potential privilege escalation if an attacker can trigger the faulty memory writes.

Mitigation Strategies

Update your Linux kernel to a version that includes the fix for this vulnerability. If you cannot update immediately, unload the cirrus-qemu driver with rmmod cirrus. Alternatively, avoid using the cirrus-qemu driver or devices that rely on it until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98142. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart