CVE-2026-98142

A flaw was found in the Linux kernel's Cirrus video driver. This vulnerability can lead to a Denial of Service (DoS) due to missing validation of the Base Address Register (BAR) memory size during device initialization. An attacker capable of attaching a crafted PCI device with an undersized memory region can cause the driver to perform an out-of-bounds write during display updates, crashing the system.

A flaw of moderate impact was found in the Linux kernel cirrus-qemu DRM driver, affecting the kernel shipped in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and the RHEL 9 CoreOS-based nodes of OpenShift Container Platform 4. During PCI probe the driver maps BAR0 without verifying that its size is at least the expected 4 MB CIRRUS_VRAM_SIZE. An attacker who is able to attach or bind a crafted PCI device with an undersized BAR0 -- which in practice requires privileged (root/administrative) control of the system or its virtualization environment -- can cause framebuffers larger than the mapped VRAM to be accepted, and a subsequent display plane update copies framebuffer data past the end of the mapped I/O memory via drm_fb_memcpy()/memcpy_toio(), producing a supervisor write page fault that crashes the kernel. The verified impact is denial of service; no confidentiality or integrity impact is demonstrated. Red Hat Enterprise Linux 6, 7, and 8, and the RHEL 8 CoreOS-based OpenShift streams, are not affected because the vulnerable code is not present in those kernels. Fixes for the affected streams are currently deferred given the limited practical exploitability (exploitation requires privileged administrative access to attach or bind a crafted PCI device); the residual risk until a fix is released is that such an attacker can crash an affected system, causing a complete denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.