Vulnerability in Cirrus-QEMU Driver for Linux Kernel

CVE-2026-98142

What is CVE-2026-98142?

A vulnerability in the Cirrus-QEMU driver within the Linux kernel arises due to inadequate validation of the Base Address Register (BAR0) size during the PCI probe. The driver assumes a fixed video RAM size, leading to potential buffer overflows when a device with a smaller BAR0 size is connected. This oversight allows for the creation of oversized framebuffers that exceed the allocated memory, which may result in system instability or crashes when the display plane is updated.

References