CVE-2026-98949

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98949", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.382Z", "datePublished": "2026-10-23T12:19:08.946Z", "dateUpdated": "2026-10-23T12:19:08.946Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-23T12:19:08.946Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: Fix reference and vm_bo handling in remap()\n\nWhen a map overlaps part of an existing mapping, pvr_vm_gpuva_remap()\nsplits the mapping into prev/next parts covering what the request did\nnot take, instead of creating something new. It gets two things wrong.\n\n- A GEM reference is taken for each part but it's never needed and never\n dropped, so it leaks one reference per split (remap-next-in-2m in\n tests/imagination/pvr_vm_map.c):\n\n CRITICAL: 33558528 bytes of shmem still held after close\n\n- The parts still belong to the original object being split, but\n pvr_vm_gpuva_remap() links them to ctx->gpuvm_bo, the new object's\n vm_bo:\n\n prev_va --obj--> BO_A BO_B <--obj-- vm_bo (ctx->gpuvm_bo)\n \\___________link___________/ (mismatch: BO_A != BO_B)\n\n drm_gpuva_link() catches the mismatch:\n\n WARNING: drivers/gpu/drm/drm_gpuvm.c:2108 at drm_gpuva_link+0x2ec/0x310\n drm_WARN_ON(obj != vm_bo->obj)\n Call trace:\n drm_gpuva_link\n pvr_vm_gpuva_remap\n __drm_gpuvm_sm_map\n pvr_vm_map\n pvr_ioctl_vm_map\n\n Link them to op->remap.unmap->va->vm_bo instead.\n\nThe locking of the GPUVA lists of the other objects touched by a split is\nnot addressed here; it is handled by switching the GPUVM to immediate\nmode."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/imagination/pvr_vm.c"], "versions": [{"version": "ff5f643de0bf27874c4033cd57a0bd034b5c7d11", "lessThan": "521cf8403a185a9d5790fe324bb43ba7ea85f51c", "status": "affected", "versionType": "git"}, {"version": "ff5f643de0bf27874c4033cd57a0bd034b5c7d11", "lessThan": "9caa2eca5cc8372517ff36a83f321d4326abae93", "status": "affected", "versionType": "git"}, {"version": "ff5f643de0bf27874c4033cd57a0bd034b5c7d11", "lessThan": "784356aa88b82035d70e9faeded49b70cddeb29e", "status": "affected", "versionType": "git"}, {"version": "ff5f643de0bf27874c4033cd57a0bd034b5c7d11", "lessThan": "196d4d10c1b33ae176685ff42a9994a5952b1d0f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/imagination/pvr_vm.c"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/521cf8403a185a9d5790fe324bb43ba7ea85f51c"}, {"url": "https://git.kernel.org/stable/c/9caa2eca5cc8372517ff36a83f321d4326abae93"}, {"url": "https://git.kernel.org/stable/c/784356aa88b82035d70e9faeded49b70cddeb29e"}, {"url": "https://git.kernel.org/stable/c/196d4d10c1b33ae176685ff42a9994a5952b1d0f"}], "title": "drm/imagination: Fix reference and vm_bo handling in remap()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/imagination/pvr_vm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "521cf8403a185a9d5790fe324bb43ba7ea85f51c", "status": "affected", "version": "ff5f643de0bf27874c4033cd57a0bd034b5c7d11", "versionType": "git"}, {"lessThan": "9caa2eca5cc8372517ff36a83f321d4326abae93", "status": "affected", "version": "ff5f643de0bf27874c4033cd57a0bd034b5c7d11", "versionType": "git"}, {"lessThan": "784356aa88b82035d70e9faeded49b70cddeb29e", "status": "affected", "version": "ff5f643de0bf27874c4033cd57a0bd034b5c7d11", "versionType": "git"}, {"lessThan": "196d4d10c1b33ae176685ff42a9994a5952b1d0f", "status": "affected", "version": "ff5f643de0bf27874c4033cd57a0bd034b5c7d11", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/imagination/pvr_vm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: Fix reference and vm_bo handling in remap()\n\nWhen a map overlaps part of an existing mapping, pvr_vm_gpuva_remap()\nsplits the mapping into prev/next parts covering what the request did\nnot take, instead of creating something new. It gets two things wrong.\n\n- A GEM reference is taken for each part but it's never needed and never\n dropped, so it leaks one reference per split (remap-next-in-2m in\n tests/imagination/pvr_vm_map.c):\n\n CRITICAL: 33558528 bytes of shmem still held after close\n\n- The parts still belong to the original object being split, but\n pvr_vm_gpuva_remap() links them to ctx->gpuvm_bo, the new object's\n vm_bo:\n\n prev_va --obj--> BO_A BO_B <--obj-- vm_bo (ctx->gpuvm_bo)\n \\___________link___________/ (mismatch: BO_A != BO_B)\n\n drm_gpuva_link() catches the mismatch:\n\n WARNING: drivers/gpu/drm/drm_gpuvm.c:2108 at drm_gpuva_link+0x2ec/0x310\n drm_WARN_ON(obj != vm_bo->obj)\n Call trace:\n drm_gpuva_link\n pvr_vm_gpuva_remap\n __drm_gpuvm_sm_map\n pvr_vm_map\n pvr_ioctl_vm_map\n\n Link them to op->remap.unmap->va->vm_bo instead.\n\nThe locking of the GPUVA lists of the other objects touched by a split is\nnot addressed here; it is handled by switching the GPUVM to immediate\nmode."}], "id": "CVE-2026-98949", "lastModified": "2026-10-23T13:17:16.037", "metrics": {}, "published": "2026-10-23T13:17:16.037", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/196d4d10c1b33ae176685ff42a9994a5952b1d0f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/521cf8403a185a9d5790fe324bb43ba7ea85f51c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/784356aa88b82035d70e9faeded49b70cddeb29e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9caa2eca5cc8372517ff36a83f321d4326abae93"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: drm/imagination: Denial of Service via improper virtual memory remapping", "id": "2559675", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559675"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-911", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/imagination: Fix reference and vm_bo handling in remap()\nWhen a map overlaps part of an existing mapping, pvr_vm_gpuva_remap()\nsplits the mapping into prev/next parts covering what the request did\nnot take, instead of creating something new. It gets two things wrong.\n- A GEM reference is taken for each part but it's never needed and never\ndropped, so it leaks one reference per split (remap-next-in-2m in\ntests/imagination/pvr_vm_map.c):\nCRITICAL: 33558528 bytes of shmem still held after close\n- The parts still belong to the original object being split, but\npvr_vm_gpuva_remap() links them to ctx->gpuvm_bo, the new object's\nvm_bo:\nprev_va --obj--> BO_A BO_B <--obj-- vm_bo (ctx->gpuvm_bo)\n\\___________link___________/ (mismatch: BO_A != BO_B)\ndrm_gpuva_link() catches the mismatch:\nWARNING: drivers/gpu/drm/drm_gpuvm.c:2108 at drm_gpuva_link+0x2ec/0x310\ndrm_WARN_ON(obj != vm_bo->obj)\nCall trace:\ndrm_gpuva_link\npvr_vm_gpuva_remap\n__drm_gpuvm_sm_map\npvr_vm_map\npvr_ioctl_vm_map\nLink them to op->remap.unmap->va->vm_bo instead.\nThe locking of the GPUVA lists of the other objects touched by a split is\nnot addressed here; it is handled by switching the GPUVM to immediate\nmode.", "A flaw was found in the Linux kernel's Imagination PowerVR graphics driver. When splitting overlapping virtual memory mappings, the driver fails to release memory references and improperly links buffer objects. A local user can exploit this vulnerability by submitting crafted memory mapping requests, potentially causing a Denial of Service (DoS) due to memory exhaustion and system instability."], "name": "CVE-2026-98949", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T12:19:08Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98949\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98949\nhttps://git.kernel.org/stable/c/196d4d10c1b33ae176685ff42a9994a5952b1d0f\nhttps://git.kernel.org/stable/c/521cf8403a185a9d5790fe324bb43ba7ea85f51c\nhttps://git.kernel.org/stable/c/784356aa88b82035d70e9faeded49b70cddeb29e\nhttps://git.kernel.org/stable/c/9caa2eca5cc8372517ff36a83f321d4326abae93"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ff5f643de0bf27874c4033cd57a0bd034b5c7d11,521cf8403a185a9d5790fe324bb43ba7ea85f51c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ff5f643de0bf27874c4033cd57a0bd034b5c7d11,9caa2eca5cc8372517ff36a83f321d4326abae93)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ff5f643de0bf27874c4033cd57a0bd034b5c7d11,784356aa88b82035d70e9faeded49b70cddeb29e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ff5f643de0bf27874c4033cd57a0bd034b5c7d11,196d4d10c1b33ae176685ff42a9994a5952b1d0f)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.8"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ff5f643de0bf27874c4033cd57a0bd034b5c7d11,521cf8403a185a9d5790fe324bb43ba7ea85f51c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ff5f643de0bf27874c4033cd57a0bd034b5c7d11,9caa2eca5cc8372517ff36a83f321d4326abae93)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ff5f643de0bf27874c4033cd57a0bd034b5c7d11,784356aa88b82035d70e9faeded49b70cddeb29e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ff5f643de0bf27874c4033cd57a0bd034b5c7d11,196d4d10c1b33ae176685ff42a9994a5952b1d0f)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.8"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T15:15:14.434569+00:00", "updated": "2026-10-29T23:30:03.080052+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}