CVE-2026-98142: drm/cirrus-qemu: Validate BAR0 size during probe
drm/cirrus-qemu: Validate BAR0 size during probe
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Compensating control
Update the cirrus-qemu driver so cirrus_pci_probe() validates that the PCI BAR0 resource size is at least CIRRUS_VRAM_SIZE (4 MB), returning -ENODEV when it is smaller.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems are exposed when a PCI device with a BAR0 smaller than 4 MB is bound to the cirrus-qemu DRM driver. The vulnerable behavior occurs because the driver assumes 4 MB of VRAM without confirming that BAR0 provides that amount.
What triggers the failure?
A framebuffer larger than the actual BAR0 mapping can be created because framebuffer validation assumes 4 MB of VRAM. When the display plane is updated, including during release, the driver copies framebuffer data to VRAM and can write beyond the mapped I/O memory, causing a supervisor write page fault.
How can I determine whether the system is affected?
Check whether the cirrus-qemu driver is bound to a PCI device whose BAR0 is smaller than 4 MB. A triggered system may log an "unable to handle page fault" message with memcpy_toio, drm_fb_memcpy, and cirrus_primary_plane_helper_atomic_update in the call trace.