CVE-2026-98142: drm/cirrus-qemu: Validate BAR0 size during probe
In the Linux kernel, the following vulnerability has been resolved:
drm/cirrus-qemu: Validate BAR0 size during probe
The cirrus-qemu driver relies on CIRRUSVRAMSIZE (4 MB) to validate framebuffer sizes. However, during PCI probe, the driver mapped BAR0 without verifying that its size matches CIRRUSVRAMSIZE.
If a PCI device with a BAR0 smaller than 4 MB is bound to the driver, the mapped VRAM will be smaller than expected. Because validation checks assume 4 MB VRAM, framebuffers larger than the mapped memory can be created.
When the display plane is updated (e.g. during release), cirrusprimaryplanehelperatomicupdate() copies the framebuffer to VRAM using drmfbmemcpy(). Writing past the end of the mapped I/O memory causes a supervisor write page fault:
BUG: unable to handle page fault for address: ffffc9000389c000 ... RIP: 0010:memcpytoio+0x7c/0xe0 arch/x86/lib/iomem.c:110 ... Call Trace: <TASK> iosysmapmemcpyto include/linux/iosys-map.h:285 [inline] drmfbmemcpy+0x325/0x5d0 drivers/gpu/drm/drmformathelper.c:442 cirrusprimaryplanehelperatomicupdate+0x98a/0xb00 drivers/gpu/drm/tiny/cirrus-qemu.c:358 drmatomichelpercommitplanes+0x626/0xea0 drivers/gpu/drm/drmatomichelper.c:3038 drmatomichelpercommittail+0x60/0x510 drivers/gpu/drm/drmatomichelper.c:1989 committail+0x2b1/0x3c0 drivers/gpu/drm/drmatomichelper.c:2074 drmatomichelpercommit+0xa77/0xb10 drivers/gpu/drm/drmatomichelper.c:2312
Fix this by validating in cirruspciprobe() that the PCI BAR0 resource is not less than CIRRUSVRAMSIZE, returning -ENODEV if it is less.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update the cirrus-qemu driver so cirrus_pci_probe() validates that the PCI BAR0 resource size is at least CIRRUS_VRAM_SIZE (4 MB), returning -ENODEV when it is smaller.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems are exposed when a PCI device with a BAR0 smaller than 4 MB is bound to the cirrus-qemu DRM driver. The vulnerable behavior occurs because the driver assumes 4 MB of VRAM without confirming that BAR0 provides that amount.
What triggers the failure?
A framebuffer larger than the actual BAR0 mapping can be created because framebuffer validation assumes 4 MB of VRAM. When the display plane is updated, including during release, the driver copies framebuffer data to VRAM and can write beyond the mapped I/O memory, causing a supervisor write page fault.
How can I determine whether the system is affected?
Check whether the cirrus-qemu driver is bound to a PCI device whose BAR0 is smaller than 4 MB. A triggered system may log an "unable to handle page fault" message with memcpy_toio, drm_fb_memcpy, and cirrus_primary_plane_helper_atomic_update in the call trace.