{"id":"CVE-2026-98566","title":"kernel: drm/imagination: clamp freelist reconstruction requests (CVE-2026-98566)","summary":"A flaw was found in the Linux kernel's drm/imagination GPU driver. The driver fails to properly validate and bound the firmware reconstruction count against the fixed protocol array capacity when processing freelist reconstruction requests…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-787","vendor":"Red Hat","product":"Linux","affected":["Linux >= 6eedddab733b350886571f98b810108b13bf74ae < b78f8f5532a077baa4aabccf657a4fb3b164659e","Linux >= 6eedddab733b350886571f98b810108b13bf74ae < e0560db0ea6e10c283ebe7c259a7af8d3b6e61a6","Linux >= 6eedddab733b350886571f98b810108b13bf74ae < eabd0ae3611769c826dbc118a1e240628731b348","Linux >= 6eedddab733b350886571f98b810108b13bf74ae < 45585c3aa285854face65293acc95eff73063d6d","Linux 6.8"],"published":"2026-10-18","updated":"2026-10-20","sourceUpdated":"2026-10-20T02:46:03+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98566.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98566.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98566"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554957"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98566"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98566"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98566.mbox"},{"url":"https://git.kernel.org/stable/c/b78f8f5532a077baa4aabccf657a4fb3b164659e"},{"url":"https://git.kernel.org/stable/c/e0560db0ea6e10c283ebe7c259a7af8d3b6e61a6"},{"url":"https://git.kernel.org/stable/c/eabd0ae3611769c826dbc118a1e240628731b348"},{"url":"https://git.kernel.org/stable/c/45585c3aa285854face65293acc95eff73063d6d"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00206,"epssPercentile":0.10481,"ingestedAt":"2026-10-18T15:45:12.258Z","slug":"CVE-2026-98566","body":"## Overview\n\nA flaw was found in the Linux kernel's drm/imagination GPU driver. The driver fails to properly validate and bound the firmware reconstruction count against the fixed protocol array capacity when processing freelist reconstruction requests. A local attacker could exploit this vulnerability by submitting oversized reconstruction requests, causing out-of-bounds memory access that may lead to memory corruption or a Denial of Service (DoS) via a system crash.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98566.json)\n\n**kernel: drm/imagination: clamp freelist reconstruction requests** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-20.\n\nNot affected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nRefer to the advisory for fix availability.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":225794,"id":"CVE-2026-98566","ts":1792498455605,"field":"cvss","old":null,"new":"5.5"},{"seq":225793,"id":"CVE-2026-98566","ts":1792498455605,"field":"severity","old":"none","new":"medium"}]}