[CVE-2026-98142][MODERATE REGULAR] drm/cirrus-qemu: Validate BAR0 size during probe [ Upstream

[CVE-2026-98142][MODERATE REGULAR] drm/cirrus-qemu: Validate BAR0 size during probe [ Upstream

[AL-KERNEL]

CVE: CVE-2026-98142
Priority: MODERATE REGULAR
AL-KERNEL base severity: MODERATE
KPANIC flag: NO
Patch: drm/cirrus-qemu: Validate BAR0 size during probe [ Upstream
Commit: 0b5084a1f070ad1fc34e11945644ae034bbc774c
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0b5084a1f070ad1fc34e11945644ae034bbc774c
Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98142
Analysis date: Fri, 25 Sep 2026 12:55:28 -0400
ActionableScore: 2
ActionableScore lower bound: unknown
Actionable bucket: Ordinary Moderate
Manual review required: NO

Summary:
An undersized Cirrus QEMU PCI BAR0 can cause an out of bounds VRAM MMIO write during framebuffer updates and trigger a kernel page fault and denial of service.

======================================================================
ABOUT THIS REPORT
======================================================================

The original Linux kernel CVE announcement for CVE-2026-98142 is available here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98142

The original announcement does not normally provide a security severity
estimate, CVSS assessment, or enough information to determine whether the
reported kernel bug represents a practically relevant security issue.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin. It combines
an autonomous classifier with LLM-assisted technical analysis and a
separate ActionableScore mechanism.

The purpose of this report is to prioritize Linux kernel CVEs before
manual review, identify cases that require prompt investigation, and
support automatic closure of issues that are unlikely to have meaningful
security impact.

Published priority for this report: MODERATE REGULAR
Manual review required: NO

A detailed explanation of the methodology and priority rules is included
at the end of this message.

======================================================================
AL-KERNEL CLASSIFICATION RESULT
======================================================================

CVE-2026-98142	MODERATE	https://www.kernelcve.org/list/?q=CVE-2026-98142 CHECK WITH IMPACT FROM ORIG NN MODERATE	Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H';*CWE-787;*CWE-20;CWE-1284;Other CVSS 'AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H';BEST CVSS score: '5.3';DESCR 'An out of bounds MMIO write in the drm cirrus qemu driver can occur because framebuffer size validation assumes a fixed 4 MB VRAM size without verifying that PCI BAR0 is at least that large. A device with a smaller BAR0 can be bound to the driver and a display plane update can copy framebuffer data beyond the mapped VRAM through drm_fb_memcpy and memcpy_toio. The demonstrated result is a supervisor write page fault and kernel crash. For the CVSS the PR:H reflects that reliably providing or binding a malformed physical or virtual PCI device normally requires administrative control of the target or its virtualization environment. The issue is not directly network reachable. A malicious virtual device provider may be adjacent to the affected guest environment. Impact is confirmed denial of service. Limited confidentiality and integrity impact is used only for the paranoid score because an out of bounds MMIO write may require manual review for nonstandard mapping layouts. No privilege escalation primitive is demonstrated by the patch.';YES REQUIRES MANUAL CHECK; ,and ActionableScore result is Ordinary Moderate (with actual score 2)	YES	DANGER HARDWARE LINUS SYZBOT  DECREASED_TO_MODERATE_REGULAR_FROM_MODERATE7_BASED_ON_GUESSCVSS_AND_CIANNH	YES	NO	checked

======================================================================
ACTIONABLESCORE ANALYSIS
======================================================================

ActionableScore=2
PrimitiveClass=CLASS_B
RealUAF=NO
HostAdminRequired=UNKNOWN
NamespaceScopedPrivilege=UNKNOWN
ImportantCandidate=NO
ManualReview=RECOMMENDED
AutoDowngradeAllowed=YES

## 1. ActionableScore

* Raw conservative score: 2
* Conservative score: 2
* Raw paranoid score: 2
* Paranoid score: 2
* Final recommended bucket: **Ordinary Moderate**::

No UAF floor, authorization floor, or Important-preserving primitive floor applies. The paranoid assessment does not add points because the supplied evidence demonstrates a page fault from an out of range MMIO write, but does not establish that the write can reach attacker-selected kernel memory, a sensitive MMIO target, or an active kernel object.

## 2. Signal breakdown

Positive signals:

* +1 Constrained kernel overwrite. The driver can write beyond the actual BAR0 backed MMIO mapping because framebuffer validation assumes CIRRUS_VRAM_SIZE while the mapped BAR0 can be smaller. The target is a fixed VRAM MMIO mapping and no attacker-controlled target selection is established.
* +1 Reliable kernel crash or strong DoS. The supplied trace demonstrates a supervisor write page fault in memcpy_toio during drm_fb_memcpy.

Negative signals:

* No privilege penalty applied. Host-admin-equivalent privilege may be required to provide or bind a malformed PCI device, but this is not fully established for every deployment and therefore must remain UNKNOWN rather than receiving an unsupported negative score.
* No rare hardware or niche subsystem penalty applied. cirrus-qemu is specialized, but the supplied context does not establish that a relevant attacker cannot reach the device configuration.

Material non-awarded signals:

* Controlled reclaim is not demonstrated.
* Arbitrary or directed kernel write is not demonstrated.
* A write beyond mapped MMIO is established, but the demonstrated target behavior is an immediate page fault rather than corruption of a selected kernel allocation or active object.
* Confidentiality impact is not awarded. No read back or disclosure path is shown.
* Integrity impact is not awarded. No protected memory, device state, file data, credential, or security policy modification is demonstrated.
* Remote network reachability is not established. The malformed BAR0 is supplied through PCI or virtual-device configuration, not ordinary network traffic.
* Local unprivileged trigger is not awarded. The supplied patch does not establish that an ordinary local user can both provide the undersized PCI BAR0 and perform the complete display-plane update sequence.
* Strong LPE plausibility is not awarded. No controlled replacement, callback control, type confusion, refcount takeover, or security-boundary bypass is shown.
* Extra Availability impact is not awarded because the same demonstrated page fault already provides the single DoS point.
* No UAF, repeated release, refcount mutation, stale-object reuse, or RCU lifetime violation is established.

## 3. Reachability analysis

The immediate prerequisite is a PCI device bound to cirrus-qemu with BAR0 smaller than 4 MB. For a physical device, supplying such a device generally depends on device control, device emulation, or privileged device-management activity. For a virtual Cirrus device, a malicious or misconfigured VMM or hypervisor can potentially expose the undersized BAR to a guest.

The supplied evidence does not establish that an ordinary guest user, ordinary logged-in desktop user, DRM client, DRM master, compositor, or display server can independently create the malformed BAR0 configuration. A guest-side display actor may be able to submit framebuffer or plane-update activity after the malformed device exists, but control over that stage alone does not establish control over the complete vulnerable sequence.

HostAdminRequired is therefore UNKNOWN. The evidence does not positively establish host-admin-equivalent privilege as mandatory in all models, but it also does not establish a complete below-host-admin trigger. NamespaceScopedPrivilege is UNKNOWN because no namespace-scoped capability or complete namespaced device-management path is supplied.

The bug is not a direct network vulnerability. The relevant external influence is device or VMM mediated, and the malformed PCI resource configuration is a material prerequisite.

## 4. Primitive and severity interpretation

The exact primitive is an out of bounds write through memcpy_toio to an MMIO VRAM mapping that is smaller than the fixed size assumed by framebuffer validation. This is not a UAF and does not involve an active stale structured object, a destructor path, a repeated release, or a lifetime/refcount mutation.

The write is constrained because the destination is derived from the Cirrus BAR0 VRAM mapping and the supplied trace shows that crossing the mapping boundary faults in memcpy_toio. The patch does not establish that writes past the BAR can reach another useful MMIO region, writable kernel memory, credentials, function pointers, or another attacker-selected target.

This is classified as CLASS_B because a real out of bounds kernel MMIO write exists, but the currently demonstrated operational consequence is kernel crash or DoS. It is not CLASS_A because no controlled target, controlled post-boundary memory corruption, arbitrary write, security-boundary bypass, or privilege-escalation mechanism is demonstrated.

ImportantCandidate is NO because the available evidence supports a constrained crash-oriented MMIO fault rather than unresolved meaningful exploitation leverage. AutoDowngradeAllowed is YES because no concrete active-object corruption, controlled replacement, post-free mutation, authorization bypass, ownership violation, or other Important-preserving primitive remains unresolved. Manual review is still recommended to determine whether a particular VMM, PCI emulation implementation, or unusual BAR layout can make the out of range MMIO write reach a non-faulting adjacent region.

Likely operational severity is ordinary Moderate or lower priority kernel DoS, primarily relevant to virtualized environments with malformed or malicious virtual PCI device configuration.

## 5. One-sentence report phrase

An undersized Cirrus QEMU PCI BAR0 can cause an out of bounds VRAM MMIO write during framebuffer updates and trigger a kernel page fault and denial of service.

## 6. Manual review recommendation

MANUAL CHECK RECOMMENDED

The patch establishes a concrete out of bounds MMIO write, but available evidence only demonstrates a page fault. Review the relevant VMM or hardware BAR mapping behavior to determine whether any deployment permits non-faulting writes into adjacent sensitive MMIO or memory regions.

## 7. Call-site confidence

Call-site confidence: medium

======================================================================
UPSTREAM PATCH SUMMARY
======================================================================

Patch: drm/cirrus-qemu: Validate BAR0 size during probe [ Upstream
Commit: 0b5084a1f070ad1fc34e11945644ae034bbc774c
Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0b5084a1f070ad1fc34e11945644ae034bbc774c

Changed files:
  drivers/gpu/drm/tiny/cirrus-qemu.c:358
  drivers/gpu/drm/drm_atomic_helper.c:3038
  drivers/gpu/drm/drm_atomic_helper.c:1989
  drivers/gpu/drm/drm_atomic_helper.c:2312

Diff excerpt:

Not included in this email. See the upstream URL for the full patch.

Full patch:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0b5084a1f070ad1fc34e11945644ae034bbc774c

======================================================================
DETAILED REPORT METHODOLOGY
======================================================================

The original Linux kernel CVE announcement for CVE-2026-98142 can be found here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98142

The original CVE announcement normally does not include a security-level
estimate. In particular, it may not contain a CVSS assessment, an impact
level, or enough information to determine whether the reported bug is a
practically relevant security issue. One purpose of this parallel CVE list
is to provide that missing technical and prioritization information.

The original goal of the AL-KERNEL project was to prioritize Linux kernel
CVE analysis automatically before manual review. The system can also help
identify non-security issues that may be suitable for automatic closure.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin.

The first analysis stage combines an autonomous classifier with additional
LLM-based analysis. The autonomous classifier runs locally on a CPU and is
based on a backpropagation neural network. Together, these mechanisms
produce a technical vulnerability description, identify likely weakness
types, estimate CVSS severity, and provide input for ActionableScore.

Two CVSS estimates are retained because incomplete kernel vulnerability
information often permits more than one defensible interpretation:

  Conservative CVSS vector: AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
  The Best / paranoid CVSS vector: AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H
  The Best / paranoid CVSS score: 5.3

The conservative vector represents a lower-impact interpretation.
The Best/paranoid vector intentionally represents a plausible upper-bound
interpretation and should not automatically be treated as demonstrated
real-world impact.

CVSS may also need to be adjusted for a particular Linux deployment,
because actual reachability, privileges, enabled kernel configuration,
hardware, namespaces, exposed device nodes, and other environmental
conditions can differ significantly between systems.

A separate ActionableScore mechanism evaluates practical remediation
urgency. Its analysis may include reachability, attack prerequisites,
subsystem exposure, memory-corruption characteristics, denial-of-service
reliability, and possible confidentiality, integrity, or
privilege-escalation impact.

  Conservative ActionableScore: unknown
  Paranoid ActionableScore: 2

The final base severity is taken directly from the second tab-separated
field of the AL-KERNEL classification result. ActionableScore does not
replace or independently override that final AL-KERNEL decision, and
if ActionableScore adjusted impact level of ALKERNEL, then you would see
self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7.

For an AL-KERNEL result of MODERATE, this report uses the following
additional presentation split:

  ActionableScore below 5   -> MODERATE REGULAR
  ActionableScore 5 or more -> MODERATE 7.0

The distinction between MODERATE REGULAR and MODERATE 7.0 makes it
possible to identify Moderate issues that should receive manual analysis
and fixes before lower-priority MODERATE REGULAR issues. In many cases,
MODERATE REGULAR fixes may wait for a later rebase or routine update.

There is one override in which MODERATE REGULAR becomes MODERATE 7.0
even when the ActionableScore is below 5. When the AL-KERNEL result
contains the KPANIC flag, a MODERATE result is always presented as
MODERATE 7.0. The KPANIC flag selected with few regexps without
usage of AI at all, so it helps to detect cases when Kernel Crash happens
and similar (to filter False-Negative results from the LLM usage).

KPANIC indicates that a reliable kernel crash, kernel panic, or similarly
serious kernel availability impact was identified by the classification
workflow.

AL-KERNEL base severity for this report: MODERATE
KPANIC detected for this report: NO
Published priority for this report (same as in Subject): MODERATE REGULAR

These results are intended to support engineering triage. They are
machine-generated estimates, and cases marked for manual review should
be validated by a human security engineer before final disposition.
For more info read docs linked from here: https://kernelcve.org/
(and you can submit you own patch there to generate such a report
for non-existant CVE-id yet).

Note that in many cases this AI tool selects higher severity, than
real is (means you can expect Importants instead of Moderate 7.0 or
Moderates 7.0 instead of regular Moderates). If you see such cases,
please use reply email interface to add additional manual analyses
info to this particular CVE.
And please, please, let me know when you see Lows instead of Importants
or Important instead of Low (because particular for such cases I
need to tune this AI tool to make it better for this one and next similar).
My contact email for such notifications is alexanjelausa@gmail.com (and both
send reply to CVE record itself too and see "reply" button below for howto reply).