CVE-2026-98623
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update If list_for_each_entry() exits without hitting a break then "pstate" is not a valid pstate pointer. Introduce a "found" variable instead. The check is reachable from userspace: nvkm_clk_ustate_update() takes the pstate id straight from the 'pstate' debugfs file, so requesting an id that is not in clk->states - or any id at all when the perf tables are broken and the list is empty - makes the pstate->pstate != req test dereference the list head cast to a struct nvkm_pstate, which is an out-of-bounds read. [Francesco: rebased on drm-misc-next, expanded the commit message]
Affected versions
Linux kernel versions
3.13
and later are affected. Fixed in
5.10.271,
5.15.222,
6.1.189,
6.6.158,
6.12.112,
6.18.55,
7.2.9,
7.3
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2026-98623?
CVE-2026-98623 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 3.13 onward and has been patched in 5.10.271, 5.15.222, 6.1.189 and others. CVE-2026-98623 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98623?
Yes. CVE-2026-98623 has been patched. Fixed versions include 5.10.271, 5.15.222, 6.1.189 and others. If you are running Linux kernel 3.13 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98623 actively exploited?
No. CVE-2026-98623 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.