CVE-2026-98623 drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
A local attacker with debugfs access can trigger an out-of-bounds read in the nouveau driver, potentially causing a kernel crash or information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98623?
CVE-2026-98623 is an use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
If list_for_each_entry() exits without hitting a break then "pstate" is not a valid pstate pointer. Introduce a "found" variable instead.
The check is reachable from userspace: nvkm_clk_ustate_update() takes the pstate id straight from the 'pstate' debugfs file, so requesting an id that is not in clk->states - or any id at all when the perf tables are broken and the list is empty - makes the pstate->pstate != req test dereference the list head cast to a struct nvkm_pstate, which is an out-of-bounds read.
[Francesco: rebased on drm-misc-next, expanded the commit message]
Which versions are affected by CVE-2026-98623?
How do I fix CVE-2026-98623?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-98623 being exploited?
There is no known exploitation of CVE-2026-98623 in the wild and no public exploit code.
Sources
Also known as AZL-108626, BELL-CVE-2026-98623, DEBIAN-CVE-2026-98623, GHSA-5c9q-m24x-7r34, UBUNTU-CVE-2026-98623.