UBUNTU-CVE-2026-98142: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: drm/cirrus-qemu: Validate BAR0 size during probe The cirrus-qemu driver relies on CIRRUSVRAMSIZE (4 MB) to validate framebuffer sizes. However, during PCI probe, the driver mapped BAR0 without verifying that its size matches CIRRUSVRAMSIZE. If a PCI device with a BAR0 smaller than 4 MB is bound to the driver, the mapped VRAM will be smaller than expected. Because validation checks assume 4 MB VRAM, framebuffers larger than the mapped memory can be created. When the display plane is updated (e.g. during release), cirrusprimaryplanehelperatomicupdate() copies the framebuffer to VRAM using drmfbmemcpy(). Writing past the end of the mapped I/O memory causes a supervisor write page fault: BUG: unable to handle page fault for address: ffffc9000389c000 ... RIP: 0010:memcpytoio+0x7c/0xe0 arch/x86/lib/iomem.c:110 ... Call Trace: <TASK> iosysmapmemcpyto include/linux/iosys-map.h:285 [inline] drmfbmemcpy+0x325/0x5d0 drivers/gpu/drm/drmformathelper.c:442 cirrusprimaryplanehelperatomicupdate+0x98a/0xb00 drivers/gpu/drm/tiny/cirrus-qemu.c:358 drmatomichelpercommitplanes+0x626/0xea0 drivers/gpu/drm/drmatomichelper.c:3038 drmatomichelpercommittail+0x60/0x510 drivers/gpu/drm/drmatomichelper.c:1989 committail+0x2b1/0x3c0 drivers/gpu/drm/drmatomichelper.c:2074 drmatomichelpercommit+0xa77/0xb10 drivers/gpu/drm/drmatomichelper.c:2312 Fix this by validating in cirruspciprobe() that the PCI BAR0 resource is not less than CIRRUSVRAMSIZE, returning -ENODEV if it is less.