{"id":"AZL-108626","summary":"CVE-2026-98623 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update\n\nIf list_for_each_entry() exits without hitting a break then \"pstate\" is\nnot a valid pstate pointer.  Introduce a \"found\" variable instead.\n\nThe check is reachable from userspace: nvkm_clk_ustate_update() takes the\npstate id straight from the 'pstate' debugfs file, so requesting an id\nthat is not in clk-\u003estates - or any id at all when the perf tables are\nbroken and the list is empty - makes the pstate-\u003epstate != req test\ndereference the list head cast to a struct nvkm_pstate, which is an\nout-of-bounds read.\n\n[Francesco: rebased on drm-misc-next, expanded the commit message]","modified":"2026-10-19T14:16:31.239357261Z","published":"2026-10-18T16:17:15Z","upstream":["CVE-2026-98623"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98623"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-108626.json"}}],"schema_version":"1.9.0"}