CVE-2026-99004: drm/imagination: Size page table preallocation by device address

Published Oct 23, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

drm/imagination: Size page table preallocation by device address

Commit 0a8224058a58 ("drm/imagination: Fix page count for page table for map() interface") passed the device address to pvrmmuopcontextcreate(), but the preallocation is still sized from deviceaddr + sgtoffset with an exclusive end. The offset into the object's pages has no place in a device-virtual range, and the exclusive end allocates one table too many when the range ends on a table boundary.

Count the tables from deviceaddr and the inclusive end of the range.

The new calculation does not take page table indices into account. This fixes another issue with the previous implementation, where the difference between start and end indices could underflow when a mapping crossed a page table boundary. This would lead to the driver preallocating a huge number of MMU pages, exhausting system memory and triggering an out of memory panic.

[Alessio: add paragraph to point out OOM bug being fixed, cc stable]

Affected Software

176 affected componentsFixes available
Linux Linux kernel
linux/kernel>=6.8.0<6.12.113
6.12.113
linux/kernel>=6.13.0<6.18.57
6.18.57
linux/kernel>=6.19.0<7.2.11
7.2.11
ubuntu/linux-hwe-edge*
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-azure*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-edge*
ubuntu/linux-oem*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-gkeop*
ubuntu/linux-gkeop-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.8*
ubuntu/linux-intel-5.13*
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.8*
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-aws-6.5*
ubuntu/linux-aws-6.8<6.8.0-1069.74~22.04.1
6.8.0-1069.74~22.04.1
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-6.5*
ubuntu/linux-azure-6.8<6.8.0-1073.82~22.04.1
6.8.0-1073.82~22.04.1
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-azure-fde-6.8<6.8.0-1071.78~22.04.1
6.8.0-1071.78~22.04.1
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gcp-6.5*
ubuntu/linux-gcp-6.8<6.8.0-1073.81~22.04.1
6.8.0-1073.81~22.04.1
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-hwe-6.5*
ubuntu/linux-ibm-6.8<6.8.0-1069.70~22.04.1
6.8.0-1069.70~22.04.1
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-lowlatency-hwe-6.5*
ubuntu/linux-lowlatency-hwe-6.8<6.8.0-149.149.1~22.04.1
6.8.0-149.149.1~22.04.1
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-6.5*
ubuntu/linux-nvidia-6.8*
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oem-6.5*
ubuntu/linux-oracle-6.5*
ubuntu/linux-oracle-6.8<6.8.0-1067.71~22.04.1
6.8.0-1067.71~22.04.1
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-riscv-6.5*
ubuntu/linux-riscv-6.8<6.8.0-149.149~22.04.2
6.8.0-149.149~22.04.2
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-starfive-6.5*
ubuntu/linux-realtime-6.8<6.8.1-1064.65~22.04.1
6.8.1-1064.65~22.04.1
ubuntu/linux<6.8.0-149.149
6.8.0-149.149
ubuntu/linux-aws<6.8.0-1069.74
6.8.0-1069.74
ubuntu/linux-aws-6.14*
ubuntu/linux-aws-6.17*
ubuntu/linux-aws-7.0<7.0.0-1017.18~24.04.1
7.0.0-1017.18~24.04.1
ubuntu/linux-azure<6.8.0-1073.82
6.8.0-1073.82
ubuntu/linux-azure-6.11*
ubuntu/linux-azure-6.14*
ubuntu/linux-azure-6.17*
ubuntu/linux-azure-7.0*
ubuntu/linux-azure-fde<6.8.0-1071.78
6.8.0-1071.78
ubuntu/linux-azure-fde-6.14*
ubuntu/linux-azure-fde-6.17*
ubuntu/linux-azure-fde-7.0<7.0.0-1019.19~24.04.1
7.0.0-1019.19~24.04.1
ubuntu/linux-azure-nvidia*
ubuntu/linux-azure-nvidia-6.14*
ubuntu/linux-gcp<6.8.0-1073.81
6.8.0-1073.81
ubuntu/linux-gcp-6.11*
ubuntu/linux-gcp-6.14*
ubuntu/linux-gcp-7.0<7.0.0-1017.19~24.04.1
7.0.0-1017.19~24.04.1
ubuntu/linux-gke<6.8.0-1068.77
6.8.0-1068.77
ubuntu/linux-gkeop<6.8.0-1053.57
6.8.0-1053.57
ubuntu/linux-hwe-6.11*
ubuntu/linux-hwe-6.14*
ubuntu/linux-hwe-6.17*
ubuntu/linux-hwe-7.0*
ubuntu/linux-ibm<6.8.0-1069.70
6.8.0-1069.70
ubuntu/linux-lowlatency<6.8.0-149.149.1
6.8.0-149.149.1
ubuntu/linux-lowlatency-hwe-6.11*
ubuntu/linux-nvidia<6.8.0-1067.70
6.8.0-1067.70
ubuntu/linux-nvidia-6.11*
ubuntu/linux-nvidia-6.17*
ubuntu/linux-nvidia-7.0*
ubuntu/linux-nvidia-lowlatency<6.8.0-1067.70.1
6.8.0-1067.70.1
ubuntu/linux-nvidia-tegra*
ubuntu/linux-oem-6.11*
ubuntu/linux-oem-6.14*
ubuntu/linux-oem-6.17*
ubuntu/linux-oem-6.8*
ubuntu/linux-oracle<6.8.0-1067.71
6.8.0-1067.71
ubuntu/linux-oracle-6.14*
ubuntu/linux-oracle-6.17*
ubuntu/linux-oracle-7.0<7.0.0-1016.18~24.04.1
7.0.0-1016.18~24.04.1
ubuntu/linux-raspi<6.8.0-1068.72
6.8.0-1068.72
ubuntu/linux-raspi-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-6.14*
ubuntu/linux-riscv-6.17*
ubuntu/linux-riscv-7.0<7.0.0-43.43.1~24.04.2
7.0.0-43.43.1~24.04.2
ubuntu/linux-vmware<6.8.0-1010.10
6.8.0-1010.10
ubuntu/linux-xilinx*
ubuntu/linux-bluefield<6.8.0-1036.41
6.8.0-1036.41
ubuntu/linux-raspi-realtime<6.8.0-2056.58
6.8.0-2056.58
ubuntu/linux-realtime<6.8.1-1064.65
6.8.1-1064.65
ubuntu/linux-realtime-6.14*
ubuntu/linux-realtime-6.17*
ubuntu/linux-aws-fips<6.8.0-1069.74+fips1
6.8.0-1069.74+fips1
ubuntu/linux-azure-fips<6.8.0-1073.82+fips1
6.8.0-1073.82+fips1
ubuntu/linux-fips*
ubuntu/linux-gcp-fips<6.8.0-1073.81+fips1
6.8.0-1073.81+fips1
ubuntu/linux<7.3.0-10.10
7.3.0-10.10
ubuntu/linux-aws<7.3.0-1004.4
7.3.0-1004.4
ubuntu/linux-azure<7.3.0-1004.4
7.3.0-1004.4
ubuntu/linux-azure-fde<7.3.0-1004.5
7.3.0-1004.5
ubuntu/linux-gcp<7.3.0-1004.4
7.3.0-1004.4
ubuntu/linux-oracle<7.3.0-1004.4
7.3.0-1004.4
ubuntu/linux-raspi<7.3.0-1004.4
7.3.0-1004.4
ubuntu/linux-realtime<7.3.0-10.10.1
7.3.0-10.10.1
ubuntu/linux-riscv<7.3.0-10.10.1
7.3.0-10.10.1
ubuntu/linux<7.0.0-43.43
7.0.0-43.43
ubuntu/linux-aws<7.0.0-1017.18
7.0.0-1017.18
ubuntu/linux-azure<7.0.0-1020.21
7.0.0-1020.21
ubuntu/linux-azure-fde<7.0.0-1019.19
7.0.0-1019.19
ubuntu/linux-gcp<7.0.0-1017.19
7.0.0-1017.19
ubuntu/linux-gke<7.0.0-1010.11
7.0.0-1010.11
ubuntu/linux-ibm<7.0.0-1018.18
7.0.0-1018.18
ubuntu/linux-nvidia*
ubuntu/linux-nvidia-bos*
ubuntu/linux-oem-7.0<7.0.0-1018.18
7.0.0-1018.18
ubuntu/linux-oracle<7.0.0-1016.18
7.0.0-1016.18
ubuntu/linux-raspi<7.0.0-1023.23
7.0.0-1023.23
ubuntu/linux-realtime<7.0.0-43.43.1
7.0.0-43.43.1
ubuntu/linux-riscv*
ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 6.12.113
  2. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 6.18.57
  3. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 7.2.11
  4. Upgrade

    Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1069.74~22.04.1
  5. Upgrade

    Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1073.82~22.04.1
  6. Upgrade

    Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1071.78~22.04.1
  7. Upgrade

    Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1073.81~22.04.1
  8. Upgrade

    Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1069.70~22.04.1
  9. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-149.149.1~22.04.1
  10. Upgrade

    Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1067.71~22.04.1
  11. Upgrade

    Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-149.149~22.04.2
  12. Upgrade

    Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.1-1064.65~22.04.1
  13. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 6.8.0-149.149
  14. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 6.8.0-1069.74
  15. Upgrade

    Upgrade ubuntu/linux-aws-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1017.18~24.04.1
  16. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 6.8.0-1073.82
  17. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 6.8.0-1071.78
  18. Upgrade

    Upgrade ubuntu/linux-azure-fde-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1019.19~24.04.1
  19. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 6.8.0-1073.81
  20. Upgrade

    Upgrade ubuntu/linux-gcp-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1017.19~24.04.1
  21. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 6.8.0-1068.77
  22. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 6.8.0-1053.57
  23. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 6.8.0-1069.70
  24. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-149.149.1
  25. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 6.8.0-1067.70
  26. Upgrade

    Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-1067.70.1
  27. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 6.8.0-1067.71
  28. Upgrade

    Upgrade ubuntu/linux-oracle-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1016.18~24.04.1
  29. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 6.8.0-1068.72
  30. Upgrade

    Upgrade ubuntu/linux-riscv-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-43.43.1~24.04.2
  31. Upgrade

    Upgrade ubuntu/linux-vmware to a version that resolves this vulnerability.

    Fixed in 6.8.0-1010.10
  32. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 6.8.0-1036.41
  33. Upgrade

    Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.0-2056.58
  34. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.1-1064.65
  35. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1069.74+fips1
  36. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1073.82+fips1
  37. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1073.81+fips1
  38. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 7.3.0-10.10
  39. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 7.3.0-1004.4
  40. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 7.3.0-1004.4
  41. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 7.3.0-1004.5
  42. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 7.3.0-1004.4
  43. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 7.3.0-1004.4
  44. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 7.3.0-1004.4
  45. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 7.3.0-10.10.1
  46. Upgrade

    Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.

    Fixed in 7.3.0-10.10.1
  47. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 7.0.0-43.43
  48. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 7.0.0-1017.18
  49. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 7.0.0-1020.21
  50. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 7.0.0-1019.19
  51. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 7.0.0-1017.19
  52. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 7.0.0-1010.11
  53. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 7.0.0-1018.18
  54. Upgrade

    Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1018.18
  55. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 7.0.0-1016.18
  56. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 7.0.0-1023.23
  57. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 7.0.0-43.43.1
  58. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch 0a8224058a58

Event History

Oct 23, 2026
CVE Published
via MITRE·12:20 PM
Data Sourced
via MITRE·12:20 PM
Description
Data Sourced
via OSV·12:20 PM
DescriptionAffected Software
Data Sourced
via NVD·01:17 PM
Description
Nov 12, 2026
Data Sourced
via OSV·05:56 PM
Severity

Frequently Asked Questions

1

What systems are exposed to the memory-exhaustion condition?

Systems using the Linux kernel's drm/imagination driver are affected when a mapping crosses a page table boundary. The faulty table-count calculation can underflow and cause the driver to preallocate a huge number of MMU pages.

2

What is the practical impact of triggering the flaw?

The excessive MMU-page preallocation can exhaust system memory and trigger an out-of-memory panic.

3

Are fixes available in stable kernel trees?

Yes. The provided references include stable kernel commits 51b56bad96fd20127034f660b337c00317c65151, f9b215b3e37a5047c406545de51bf8a2aeb4cd1c, and 7f73da0facf864fe796371ebaccacb1fee678aaf.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203