In the Linux kernel, the following vulnerability has been resolved: drm/imagination: clamp freelist reconstruction requests The firmware… (CVE-2026-98566)

CVE-2026-98566 addresses a flaw in the Linux kernel's drm/imagination driver where the firmware reconstruction count was not properly bounded when accessing the fixed freelist ID array and copying into the fixed response array. This lack of bounds checking could lead to out-of-bounds accesses. The remediation clamps the reconstruction count to the request capacity, ensuring consistent and safe handling of reconstruction and response publication. The fix preserves the firmware recovery exchange protocol rather than dropping oversized requests, as coordinated with the firmware maintainer. The vulnerability was discovered using static analysis tools.

The vulnerability could allow out-of-bounds memory access within the drm/imagination driver's firmware reconstruction process. This may lead to memory corruption or instability in the kernel component handling graphics device firmware. No known exploits in the wild have been reported. The impact is limited to the affected kernel component and depends on the ability to trigger oversized reconstruction requests.

A fix has been implemented in the Linux kernel to clamp the freelist reconstruction request count to the request capacity, preventing out-of-bounds accesses. Users should update to the patched kernel version once available. No alternative mitigations are indicated. Patch status is not explicitly confirmed in the provided data; check the official Linux kernel advisories for the exact fixed versions and update instructions.