CVE-2026-99004 - Vulnerability Details

- drm/imagination: Size page table preallocation by device address

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/imagination: Size page table preallocation by device address

Commit 0a8224058a58 ("drm/imagination: Fix page count for page table for
map() interface") passed the device address to
pvr_mmu_op_context_create(), but the preallocation is still sized from
device_addr + sgt_offset with an exclusive end. The offset into the
object's pages has no place in a device-virtual range, and the exclusive
end allocates one table too many when the range ends on a table
boundary.

Count the tables from device_addr and the inclusive end of the range.

The new calculation does not take page table indices into account. This
fixes another issue with the previous implementation, where the
difference between start and end indices could underflow when a mapping
crossed a page table boundary. This would lead to the driver
preallocating a huge number of MMU pages, exhausting system memory and
triggering an out of memory panic.

[Alessio: add paragraph to point out OOM bug being fixed, cc stable]

Published: 2026-10-23

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability lies in the Linux kernel's Imagination Technologies DRM driver, where the page table preallocation size is incorrectly computed. The calculation used the device address plus an exclusive range end, leading to an underflow when the mapping crosses a page table boundary. The resulting mis‑calculation can allocate an excessively large number of MMU pages, exhausting system memory and causing a kernel out‑of‑memory panic. Attackers who can trigger an invalid mapping can thus force the kernel to lose memory, potentially crashing the system.

Affected Systems

All Linux kernel installations that employ the Imagination Technologies DRM driver prior to the inclusion of commit 0a822405. The affected code resides in the kernel's DRM subsystem, and any version before this fix is potentially vulnerable.

Risk and Exploitability

The flaw is a local kernel memory management bug; exploitation requires the ability to request a memory mapping via the Imagination DRM interface. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, implying no publicly known exploits. Nevertheless, the bug can trigger a denial‑of‑service by exhausting memory and panicking the kernel, so its impact is medium. The CVSS score of 5.5 indicates a moderate severity, reflecting the risk to availability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ff5f643de0bf27874c4033cd57a0bd034b5c7d11`	affected	< 51b56bad96fd20127034f660b337c00317c65151
`ff5f643de0bf27874c4033cd57a0bd034b5c7d11`	affected	< f9b215b3e37a5047c406545de51bf8a2aeb4cd1c
`ff5f643de0bf27874c4033cd57a0bd034b5c7d11`	affected	< 7f73da0facf864fe796371ebaccacb1fee678aaf
`ff5f643de0bf27874c4033cd57a0bd034b5c7d11`	affected	< 789f290b2e81d42820bddcb4010ffbc2ae2ded54

Linux

affected

Version	Status	Constraints
`6.8`	affected	—
`0`	unaffected	< 6.8
`6.12.113`	unaffected	≤ 6.12.*
`6.18.57`	unaffected	≤ 6.18.*
`7.2.11`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[ff5f643de0bf27874c4033cd57a0bd034b5c7d11,51b56bad96fd20127034f660b337c00317c65151)`	affected	code_commit	—
`[ff5f643de0bf27874c4033cd57a0bd034b5c7d11,f9b215b3e37a5047c406545de51bf8a2aeb4cd1c)`	affected	code_commit	—
`[ff5f643de0bf27874c4033cd57a0bd034b5c7d11,7f73da0facf864fe796371ebaccacb1fee678aaf)`	affected	code_commit	—
`[ff5f643de0bf27874c4033cd57a0bd034b5c7d11,789f290b2e81d42820bddcb4010ffbc2ae2ded54)`	affected	code_commit	—

Linux

100%

Version	Status	Scheme	Platform
`6.8`	affected	generic	—
`[0,6.8)`	unaffected	generic	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.57,6.19.0)`	unaffected	semver	—
`[7.2.11,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[ff5f643de0bf27874c4033cd57a0bd034b5c7d11,51b56bad96fd20127034f660b337c00317c65151)`	affected	code_commit	—
`[ff5f643de0bf27874c4033cd57a0bd034b5c7d11,f9b215b3e37a5047c406545de51bf8a2aeb4cd1c)`	affected	code_commit	—
`[ff5f643de0bf27874c4033cd57a0bd034b5c7d11,7f73da0facf864fe796371ebaccacb1fee678aaf)`	affected	code_commit	—
`[ff5f643de0bf27874c4033cd57a0bd034b5c7d11,789f290b2e81d42820bddcb4010ffbc2ae2ded54)`	affected	code_commit	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`6.8`	affected	generic	—
`[0,6.8)`	unaffected	generic	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.57,6.19.0)`	unaffected	semver	—
`[7.2.11,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that incorporates commit 0a822405, which corrects the page table size calculation.
Backport the specific patch from commit 0a822405 to the current running kernel if an upgrade is not possible.
Temporarily disable the Imagination Technologies DRM driver or any modules that rely on it while a permanent fix is deployed.

Generated by OpenCVE AI on October 29, 2026 at 20:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99004.mbox
https://git.kernel.org/stable/c/51b56bad96fd20127034f660b337c00317c65151
https://git.kernel.org/stable/c/789f290b2e81d42820bddcb4010ffbc2ae2ded54
https://git.kernel.org/stable/c/7f73da0facf864fe796371ebaccacb1fee678aaf
https://git.kernel.org/stable/c/f9b215b3e37a5047c406545de51bf8a2aeb4cd1c
https://nvd.nist.gov/vuln/detail/CVE-2026-99004
https://www.cve.org/CVERecord?id=CVE-2026-99004

History

Thu, 29 Oct 2026 19:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-680 CWE-682

Thu, 29 Oct 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-191
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99004.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-99004 https://www.cve.org/CVERecord?id=CVE-2026-99004
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 23 Oct 2026 19:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 15:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-680 CWE-682

Fri, 23 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 ("drm/imagination: Fix page count for page table for map() interface") passed the device address to pvr_mmu_op_context_create(), but the preallocation is still sized from device_addr + sgt_offset with an exclusive end. The offset into the object's pages has no place in a device-virtual range, and the exclusive end allocates one table too many when the range ends on a table boundary. Count the tables from device_addr and the inclusive end of the range. The new calculation does not take page table indices into account. This fixes another issue with the previous implementation, where the difference between start and end indices could underflow when a mapping crossed a page table boundary. This would lead to the driver preallocating a huge number of MMU pages, exhausting system memory and triggering an out of memory panic. [Alessio: add paragraph to point out OOM bug being fixed, cc stable]
Title		drm/imagination: Size page table preallocation by device address
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/51b56bad96fd20127034f660b337c00317c65151 https://git.kernel.org/stable/c/789f290b2e81d42820bddcb4010ffbc2ae2ded54 https://git.kernel.org/stable/c/7f73da0facf864fe796371ebaccacb1fee678aaf https://git.kernel.org/stable/c/f9b215b3e37a5047c406545de51bf8a2aeb4cd1c

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T12:20:29.122Z

Updated: 2026-10-23T12:20:29.122Z

Reserved: 2026-09-25T10:25:14.385Z

Link: CVE-2026-99004

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T13:17:22.783

Modified: 2026-10-23T13:17:22.783

Link: CVE-2026-99004

Redhat

Severity : Moderate

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-99004 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-29T21:00:21Z

Weaknesses

CWE-191
Integer Underflow (Wrap or Wraparound)

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object