In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update If… (CVE-2026-98623)

The vulnerability in the Linux kernel's drm/nouveau/clk subsystem involves improper handling of a list cursor in the nvkm_clk_ustate_update function. Specifically, if the list_for_each_entry() loop completes without a break, the pointer 'pstate' is invalid. Since nvkm_clk_ustate_update accepts the pstate id directly from the 'pstate' debugfs file, a userspace request for a non-existent pstate id or when the performance tables are empty causes the code to dereference the list head cast as a struct nvkm_pstate, resulting in an out-of-bounds read. The fix introduced a 'found' variable to track whether a valid pstate was found, preventing invalid pointer dereference.

The vulnerability allows an out-of-bounds read in kernel memory triggered by userspace via debugfs interface. This could potentially lead to information disclosure or kernel instability. However, no known exploits in the wild have been reported. The impact is limited to systems with the affected drm/nouveau/clk component and where userspace can interact with the 'pstate' debugfs file.

A fix has been implemented in the Linux kernel to address this vulnerability by adding a 'found' variable to ensure pointer validity after list traversal. Users should update their Linux kernel to a version that includes this fix. No additional mitigation steps are indicated by the vendor advisory.