Out-of-bounds Write Affecting kernel-modules-extra package, versions *
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-CENTOS10-KERNELMODULESEXTRA-20214165
- published29 Sept 2026
- disclosed25 Sept 2026
Introduced: 25 Sep 2026
NewCVE-2026-98142 (opens in a new tab)How to fix?
There is no fixed version for Centos:10 kernel-modules-extra.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-modules-extra package and not the kernel-modules-extra package as distributed by Centos.
See How to fix? for Centos:10 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
drm/cirrus-qemu: Validate BAR0 size during probe
The cirrus-qemu driver relies on CIRRUS_VRAM_SIZE (4 MB) to validate
framebuffer sizes. However, during PCI probe, the driver mapped BAR0
without verifying that its size matches CIRRUS_VRAM_SIZE.
If a PCI device with a BAR0 smaller than 4 MB is bound to the driver, the mapped VRAM will be smaller than expected. Because validation checks assume 4 MB VRAM, framebuffers larger than the mapped memory can be created.
When the display plane is updated (e.g. during release),
cirrus_primary_plane_helper_atomic_update() copies the framebuffer to
VRAM using drm_fb_memcpy(). Writing past the end of the mapped I/O memory
causes a supervisor write page fault:
BUG: unable to handle page fault for address: ffffc9000389c000 ... RIP: 0010:memcpy_toio+0x7c/0xe0 arch/x86/lib/iomem.c:110 ... Call Trace: <TASK> iosys_map_memcpy_to include/linux/iosys-map.h:285 [inline] drm_fb_memcpy+0x325/0x5d0 drivers/gpu/drm/drm_format_helper.c:442 cirrus_primary_plane_helper_atomic_update+0x98a/0xb00 drivers/gpu/drm/tiny/cirrus-qemu.c:358 drm_atomic_helper_commit_planes+0x626/0xea0 drivers/gpu/drm/drm_atomic_helper.c:3038 drm_atomic_helper_commit_tail+0x60/0x510 drivers/gpu/drm/drm_atomic_helper.c:1989 commit_tail+0x2b1/0x3c0 drivers/gpu/drm/drm_atomic_helper.c:2074 drm_atomic_helper_commit+0xa77/0xb10 drivers/gpu/drm/drm_atomic_helper.c:2312
Fix this by validating in cirrus_pci_probe() that the PCI BAR0 resource
is not less than CIRRUS_VRAM_SIZE, returning -ENODEV if it is less.
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2541348
- https://access.redhat.com/security/cve/CVE-2026-98142
- https://git.kernel.org/stable/c/0b5084a1f070ad1fc34e11945644ae034bbc774c
- https://git.kernel.org/stable/c/144f51cd0ccc3ad47a6099917b7bb535611fb18f
- https://git.kernel.org/stable/c/26bd90c886218f36c9adeab206b0e27b4384e2f6
- https://git.kernel.org/stable/c/92312d333bf700798f92f30406c721bce87506f3