Linux kernel CVE-2026-98142

Exploitation requires a PCI device whose BAR0 resource is smaller than CIRRUS_VRAM_SIZE (4 MB) to be bound to the cirrus-qemu driver; the standard QEMU Cirrus device provides a 4 MB BAR0, so default configurations are NOT affected. Binding an arbitrary/undersized PCI device to a kernel driver is a privileged operation (effectively host/hypervisor control over the emulated hardware or root-level device binding inside the guest). The fault is then reached only when a display-plane atomic update copies an oversized framebuffer into the undersized mapping. Limiting factors: local access only (AV:L), a non-default/malformed device is required, elevated privilege to perform the bind, and the outcome is a crash (DoS) with no confidentiality or integrity impact.

This is a moderate-severity, availability-only defect (CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) in the Linux kernel's drm/cirrus-qemu tiny DRM driver, classified CWE-787 (out-of-bounds write). The impact is a kernel page fault / crash (denial of service) with no stated confidentiality or integrity impact - consistent with C:N/I:N/A:H. All exploitation signals point AWAY from urgency: EPSS is 0.16% (4th percentile), the vulnerability is NOT in CISA KEV, and no public exploit or PoC is present - the listed references are all kernel.org stable patch commits and advisory pages (git.kernel.org, NVD, VulDB, EUVD), not exploit code. The vuln.today decision label is 'this_month' (not act_now/emergency), which aligns with the low EPSS and absence of active exploitation. One signal to weigh carefully: the supplied CVSS uses AC:L/PR:L, but the description's trigger - a PCI device whose BAR0 is smaller than the 4 MB CIRRUS_VRAM_SIZE being bound to the driver - is a non-default, operator/privilege-dependent condition rather than something a low-privileged user triggers against a stock system; see the independent assessment below. Net: a real but low-priority bug to fold into the normal kernel patch cycle, not an emergency.

In a virtualized setup, a PCI device exposing a BAR0 smaller than 4 MB is bound to the cirrus-qemu driver, which maps the undersized region as VRAM but still validates framebuffers against the hard-coded 4 MB CIRRUS_VRAM_SIZE. A framebuffer larger than the mapped memory is then created and, on a display-plane update (e.g. during release), cirrus_primary_plane_helper_atomic_update() calls drm_fb_memcpy()/memcpy_toio() and writes past the end of the mapped I/O memory, producing a supervisor-write page fault that crashes the kernel. No public exploit code is identified at time of analysis; the trigger requires the specific undersized-BAR0 device condition described in the report.