CVE-2026-98623 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
If list_for_each_entry() exits without hitting a break then "pstate" is not a valid pstate pointer. Introduce a "found" variable instead.
The check is reachable from userspace: nvkm_clk_ustate_update() takes the pstate id straight from the 'pstate' debugfs file, so requesting an id that is not in clk->states - or any id at all when the perf tables are broken and the list is empty - makes the pstate->pstate != req test dereference the list head cast to a struct nvkm_pstate, which is an out-of-bounds read.
[Francesco: rebased on drm-misc-next, expanded the commit message]
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified in the Linux kernel's Nouveau DRM driver involves a critical use-after-free or invalid pointer dereference within the clock management subsystem. Specifically, the function nvkm_clk_ustate_update processes performance state requests originating from user space via the debugfs interface. The core technical flaw lies in the implementation of list iteration logic using the macro list_for_each_entry. When this loop completes without finding a matching entry or encountering an explicit break statement, the iterator variable pstate retains its final value rather than being reset to indicate failure. In C programming with kernel data structures, if the loop condition fails immediately because the list is empty, the pointer may point to invalid memory regions such as the list head itself when cast incorrectly to a struct nvkm_pstate type. This results in an out-of-bounds read operation where the code attempts to access members of a non-existent or misinterpreted structure.
This flaw creates a direct path for exploitation from unprivileged user space contexts because the input parameter pstate is derived directly from debugfs files without sufficient validation against available performance states. An attacker can supply a pstate identifier that does not exist in the current clk->states list, or exploit scenarios where hardware perf tables are corrupted resulting in an empty state list. The immediate operational impact includes kernel memory corruption and potential information disclosure through out-of-bounds reads. Depending on the specific memory layout at runtime, this invalid dereference could lead to a system crash causing denial of service conditions for all users on the affected machine. In more complex exploitation scenarios involving subsequent writes or further processing of corrupted pointers, it might facilitate privilege escalation allowing an unprivileged user to execute arbitrary code with kernel-level privileges.
From a vulnerability classification perspective, this issue aligns closely with CWE-125 Out-of-bounds Read and CWE-416 Use After Free depending on the exact memory state during exploitation. The attack vector is classified under ATT&CK technique T1059 Command and Scripting Interpreter via debugfs interaction or potentially T1078 Valid Accounts if leveraging existing user permissions to access debug interfaces. Mitigation strategies primarily involve applying the upstream kernel patch that introduces a found flag variable to properly track whether a valid pstate was located during iteration. System administrators should ensure their systems are updated with patched versions of the Linux kernel and Nouveau driver components. Additionally, restricting access to debugfs files for unprivileged users can reduce the attack surface by preventing direct manipulation of performance state identifiers until proper validation mechanisms are enforced within the application layer or through mandatory access control policies like SELinux configurations that limit write permissions on sensitive device interfaces.