In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit… (CVE-2026-99004)

The Linux kernel drm/imagination driver had a flaw in the page table preallocation logic where the size was incorrectly calculated using device address plus an offset, leading to an exclusive end that allocated one table too many. Additionally, the previous implementation risked underflow in the difference between start and end indices when a mapping crossed a page table boundary. This caused the driver to preallocate an excessive number of MMU pages, exhausting system memory and triggering OOM panics. The fix adjusts the calculation to count tables from the device address with an inclusive end, eliminating the underflow and preventing excessive memory allocation.

The vulnerability could cause the system to exhaust memory due to excessive MMU page preallocation, resulting in an out of memory panic. This impacts system stability and availability but does not indicate direct code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to correct the page table preallocation calculation in the drm/imagination driver. Users should apply the official kernel update containing this fix to resolve the issue. No additional mitigation is indicated.