CVE-2026-98886 - Vulnerability Details

- drm/gma500: return errors from Oaktrail HDMI I2C reads

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/gma500: return errors from Oaktrail HDMI I2C reads

xfer_read() waits for the HDMI I2C transaction to reach
I2C_TRANSACTION_DONE, but it ignores both timeout and signal returns from
wait_for_completion_interruptible_timeout(). If the interrupt never
advances the transaction state, the loop can wait forever.

Return -ETIMEDOUT when the completion wait expires, propagate interrupted
waits, and make the I2C master_xfer callback return the first transfer
error instead of reporting a successful message count.

Published: 2026-10-23

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel DRM GMA500 driver for Oaktrail hardware contains a flaw in its HDMI I2C read routine. The routine waits for an I2C transaction to finish but discards timeout and interrupt return values, potentially causing the wait loop to never terminate. This leads to a kernel thread hanging in an endless loop, which can stall HDMI stack operations and contribute to a denial‑of‑service condition.

Affected Systems

The vulnerability affects all Linux kernel builds that include the DRM GMA500 driver with support for Oaktrail hardware. Any system running such a kernel with the driver enabled, regardless of whether HDMI output is actively used, is at risk.

Risk and Exploitability

Exploitation requires the ability to trigger an HDMI I2C transaction, which is normally performed by the kernel when the driver is active. An attacker with sufficient privileges to invoke the driver or interact with the HDMI subsystem could cause the error path. The CVSS score is 5.5, the EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. While the attack surface is limited to kernel context, the resulting infinite loop can lock up the system, indicating moderate probability of exploitation in environments without timely patching.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1e585b52fd8ea59792634bc31d227eb3456af22e`	affected	< 09a950950e7e4e74e021e60941c8e816ef1b4f71
`1e585b52fd8ea59792634bc31d227eb3456af22e`	affected	< 898d209157fe2a245f7d9fe28c5921037d8b5033
`1e585b52fd8ea59792634bc31d227eb3456af22e`	affected	< 15c6d7f7127a53b7312232178ecf03e5850161d2
`1e585b52fd8ea59792634bc31d227eb3456af22e`	affected	< 8add43887cca1fe11a0ded62199ce726901d3f20
`1e585b52fd8ea59792634bc31d227eb3456af22e`	affected	< f85e8224bd4e1a0939cbfe13a6220fbddf61127c
`1e585b52fd8ea59792634bc31d227eb3456af22e`	affected	< c268df0653ab07bafc3d191e74ea097e3d9b9e69
`1e585b52fd8ea59792634bc31d227eb3456af22e`	affected	< 9b5ce5c496efd20c1c662cedba88465d39ec1f93

Linux

affected

Version	Status	Constraints
`3.1`	affected	—
`0`	unaffected	< 3.1
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,09a950950e7e4e74e021e60941c8e816ef1b4f71)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,898d209157fe2a245f7d9fe28c5921037d8b5033)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,15c6d7f7127a53b7312232178ecf03e5850161d2)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8add43887cca1fe11a0ded62199ce726901d3f20)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f85e8224bd4e1a0939cbfe13a6220fbddf61127c)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c268df0653ab07bafc3d191e74ea097e3d9b9e69)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,9b5ce5c496efd20c1c662cedba88465d39ec1f93)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

100%

Version	Status	Scheme	Platform
`[5.10.271,*]`	unaffected	generic	—
`[5.15.222,*]`	unaffected	generic	—
`[6.1.189,*]`	unaffected	generic	—
`[6.6.158,*]`	unaffected	generic	—
`[6.12.111,*]`	unaffected	generic	—
`[6.18.53,*]`	unaffected	generic	—
`[7.2,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,09a950950e7e4e74e021e60941c8e816ef1b4f71)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,898d209157fe2a245f7d9fe28c5921037d8b5033)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,15c6d7f7127a53b7312232178ecf03e5850161d2)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8add43887cca1fe11a0ded62199ce726901d3f20)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f85e8224bd4e1a0939cbfe13a6220fbddf61127c)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c268df0653ab07bafc3d191e74ea097e3d9b9e69)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,9b5ce5c496efd20c1c662cedba88465d39ec1f93)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[5.10.271,*]`	unaffected	generic	—
`[5.15.222,*]`	unaffected	generic	—
`[6.1.189,*]`	unaffected	generic	—
`[6.6.158,*]`	unaffected	generic	—
`[6.12.111,*]`	unaffected	generic	—
`[6.18.53,*]`	unaffected	generic	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the patch for the DRM GMA500 HDMI driver.
If a kernel update cannot be applied immediately, disable the GMA500 HDMI driver module or unbind the driver from its devices using sysfs interfaces or a kernel boot parameter to prevent the vulnerable code from running.
Monitor system logs for HDMI I2C timeout events and reboot or restart affected services when a hang is detected.

Generated by OpenCVE AI on October 27, 2026 at 10:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00187.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98886.mbox
https://git.kernel.org/stable/c/09a950950e7e4e74e021e60941c8e816ef1b4f71
https://git.kernel.org/stable/c/15c6d7f7127a53b7312232178ecf03e5850161d2
https://git.kernel.org/stable/c/898d209157fe2a245f7d9fe28c5921037d8b5033
https://git.kernel.org/stable/c/8add43887cca1fe11a0ded62199ce726901d3f20
https://git.kernel.org/stable/c/9b5ce5c496efd20c1c662cedba88465d39ec1f93
https://git.kernel.org/stable/c/c268df0653ab07bafc3d191e74ea097e3d9b9e69
https://git.kernel.org/stable/c/f85e8224bd4e1a0939cbfe13a6220fbddf61127c
https://nvd.nist.gov/vuln/detail/CVE-2026-98886
https://www.cve.org/CVERecord?id=CVE-2026-98886

History

Tue, 27 Oct 2026 09:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-400

Tue, 27 Oct 2026 04:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-835
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98886.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98886 https://www.cve.org/CVERecord?id=CVE-2026-98886
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 23 Oct 2026 18:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-400

Fri, 23 Oct 2026 14:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 12:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/gma500: return errors from Oaktrail HDMI I2C reads xfer_read() waits for the HDMI I2C transaction to reach I2C_TRANSACTION_DONE, but it ignores both timeout and signal returns from wait_for_completion_interruptible_timeout(). If the interrupt never advances the transaction state, the loop can wait forever. Return -ETIMEDOUT when the completion wait expires, propagate interrupted waits, and make the I2C master_xfer callback return the first transfer error instead of reporting a successful message count.
Title		drm/gma500: return errors from Oaktrail HDMI I2C reads
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/09a950950e7e4e74e021e60941c8e816ef1b4f71 https://git.kernel.org/stable/c/15c6d7f7127a53b7312232178ecf03e5850161d2 https://git.kernel.org/stable/c/898d209157fe2a245f7d9fe28c5921037d8b5033 https://git.kernel.org/stable/c/8add43887cca1fe11a0ded62199ce726901d3f20 https://git.kernel.org/stable/c/9b5ce5c496efd20c1c662cedba88465d39ec1f93 https://git.kernel.org/stable/c/c268df0653ab07bafc3d191e74ea097e3d9b9e69 https://git.kernel.org/stable/c/f85e8224bd4e1a0939cbfe13a6220fbddf61127c

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T11:37:43.338Z

Updated: 2026-10-26T06:56:10.643Z

Reserved: 2026-09-25T10:25:14.378Z

Link: CVE-2026-98886

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T12:18:22.340

Modified: 2026-10-26T07:17:13.610

Link: CVE-2026-98886

Redhat

Severity : Moderate

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-98886 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-27T10:45:06Z

Weaknesses

CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object