CVE-2026-98142: drm/cirrus-qemu: Validate BAR0 size during probe
drm/cirrus-qemu: Validate BAR0 size during probe
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.158 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.111 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.53 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.7 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.115-2~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In cirrus_pci_probe(), validate that the PCI BAR0 resource is at least CIRRUS_VRAM_SIZE (4 MB); if it is smaller, reject the device by returning -ENODEV.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems are exposed when a PCI device with a BAR0 smaller than 4 MB is bound to the cirrus-qemu DRM driver. The vulnerable behavior occurs because the driver assumes 4 MB of VRAM without confirming that BAR0 provides that amount.
What triggers the failure?
A framebuffer larger than the actual BAR0 mapping can be created because framebuffer validation assumes 4 MB of VRAM. When the display plane is updated, including during release, the driver copies framebuffer data to VRAM and can write beyond the mapped I/O memory, causing a supervisor write page fault.
How can I determine whether the system is affected?
Check whether the cirrus-qemu driver is bound to a PCI device whose BAR0 is smaller than 4 MB. A triggered system may log an "unable to handle page fault" message with memcpy_toio, drm_fb_memcpy, and cirrus_primary_plane_helper_atomic_update in the call trace.