CVE-2026-98142

A flaw of moderate impact was found in the Linux kernel cirrus-qemu DRM driver, affecting the kernel shipped in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and the RHEL 9 CoreOS-based nodes of OpenShift Container Platform 4. During PCI probe the driver maps BAR0 without verifying that its size is at least the expected 4 MB CIRRUS_VRAM_SIZE. An attacker who is able to attach or bind a crafted PCI device with an undersized BAR0 -- which in practice requires privileged (root/administrative) control of the system or its virtualization environment -- can cause framebuffers larger than the mapped VRAM to be accepted, and a subsequent display plane update copies framebuffer data past the end of the mapped I/O memory via drm_fb_memcpy()/memcpy_toio(), producing a supervisor write page fault that crashes the kernel. The verified impact is denial of service; no confidentiality or integrity impact is demonstrated. Red Hat Enterprise Linux 6, 7, and 8, and the RHEL 8 CoreOS-based OpenShift streams, are not affected because the vulnerable code is not present in those kernels. Fixes for the affected streams are currently deferred given the limited practical exploitability (exploitation requires privileged administrative access to attach or bind a crafted PCI device); the residual risk until a fix is released is that such an attacker can crash an affected system, causing a complete denial of service.