{"id":29296,"date":"2026-09-25T20:32:22","date_gmt":"2026-09-25T12:32:22","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98142"},"modified":"2026-09-25T20:32:22","modified_gmt":"2026-09-25T12:32:22","slug":"cve-2026-98142","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98142","title":{"rendered":"CVE-2026-98142 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\ndrm\/cirrus-qemu: Vali"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>drm\/cirrus-qemu: Validate BAR0 size during probe<\/p>\n<p>The `cirrus-qemu` driver relies on `CIRRUS_VRAM_SIZE` (4 MB) to validate<br \/>\nframebuffer sizes. However, during PCI probe, the driver mapped BAR0<br \/>\nwithout verifying that its size matches `CIRRUS_VRAM_SIZE`.<\/p>\n<p>If a PCI device with a BAR0 smaller than 4 MB is bound to the driver, the<br \/>\nmapped VRAM will be smaller than expected. Because validation checks assume<br \/>\n4 MB VRAM, framebuffers larger than the mapped memory can be created.<\/p>\n<p>When the display plane is updated (e.g. during release),<br \/>\n`cirrus_primary_plane_helper_atomic_update()` copies the framebuffer to<br \/>\nVRAM using `drm_fb_memcpy()`. Writing past the end of the mapped I\/O memory<br \/>\ncauses a supervisor write page fault:<\/p>\n<p>BUG: unable to handle page fault for address: ffffc9000389c000<br \/>\n&#8230;<br \/>\nRIP: 0010:memcpy_toio+0x7c\/0xe0 arch\/x86\/lib\/iomem.c:110<br \/>\n&#8230;<br \/>\nCall Trace:<\/p>\n<p> iosys_map_memcpy_to include\/linux\/iosys-map.h:285 [inline]<br \/>\n drm_fb_memcpy+0x325\/0x5d0 drivers\/gpu\/drm\/drm_format_helper.c:442<br \/>\n cirrus_primary_plane_helper_atomic_update+0x98a\/0xb00<br \/>\n drivers\/gpu\/drm\/tiny\/cirrus-qemu.c:358<br \/>\n drm_atomic_helper_commit_planes+0x626\/0xea0<br \/>\n drivers\/gpu\/drm\/drm_atomic_helper.c:3038<br \/>\n drm_atomic_helper_commit_tail+0x60\/0x510<br \/>\n drivers\/gpu\/drm\/drm_atomic_helper.c:1989<br \/>\n commit_tail+0x2b1\/0x3c0 drivers\/gpu\/drm\/drm_atomic_helper.c:2074<br \/>\n drm_atomic_helper_commit+0xa77\/0xb10<br \/>\n drivers\/gpu\/drm\/drm_atomic_helper.c:2312<\/p>\n<p>Fix this by validating in `cirrus_pci_probe()` that the PCI BAR0 resource<br \/>\nis not less than `CIRRUS_VRAM_SIZE`, returning `-ENODEV` if it is less.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>drm\/cirrus-qemu: Validate BAR0 size during probe<\/p>\n<p>The `cirrus-qemu` driver relies on `CIRRUS_VRAM_SIZE` (4 MB) to validate<br \/>\nframebuf<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29296","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29296","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29296"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29296"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29296"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}