CVE-2026-99004: Linux kernel · drm/imagination: Size page table preallocation by device address
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in f9b215b3e37a5047c406545de51bf8a2aeb4cd1c : patch Linux kernel soon.
Data as of 26 Oct 2026, 12:55 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in f9b215b3e37a5047c406545de51bf8a2aeb4cd1c, 789f290b2e81d42820bddcb4010ffbc2ae2ded54, 51b56bad96fd20127034f660b337c00317c65151 +1
Exploitation evidence
Disclosed: evidence found.
CVE published 23 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to f9b215b3e37a5047c406545de51bf8a2aeb4cd1c, 789f290b2e81d42820bddcb4010ffbc2ae2ded54, 51b56bad96fd20127034f660b337c00317c65151 or 7f73da0facf864fe796371ebaccacb1fee678aaf.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix is available and has been applied in the Linux kernel. Users should update to the fixed versions identified by the commits f9b215b3e37a5047c406545de51bf8a2aeb4cd1c, 789f290b2e81d42820bddcb4010ffbc2ae2ded54, 51b56bad96fd20127034f660b337c00317c65151, and 7f73da0facf864fe796371ebaccacb1fee678aaf. Applying these updates will resolve the issue and prevent out of memory panics caused by this vulnerability.
Description
A vulnerability in the Linux kernel's drm/imagination driver caused incorrect sizing of page table preallocation by device address. This flaw led to excessive memory allocation, potentially exhausting system memory and causing an out of memory panic. The issue was fixed by correcting the calculation of page tables to properly count from the device address and inclusive end of the range, preventing underflow and over-allocation.
References
- git.kernel.org/stable/c/51b56bad96fd20127034f660b337c00317c65151 (opens in a new tab)
- git.kernel.org/stable/c/f9b215b3e37a5047c406545de51bf8a2aeb4cd1c (opens in a new tab)
- git.kernel.org/stable/c/7f73da0facf864fe796371ebaccacb1fee678aaf (opens in a new tab)
- git.kernel.org/stable/c/789f290b2e81d42820bddcb4010ffbc2ae2ded54 (opens in a new tab)