{"id":"CVE-2026-98875","title":"kernel: drm/nouveau/gsp: add SEC2 to GA100 chip table (CVE-2026-98875)","summary":"A flaw was found in the Linux kernel's Nouveau GPU driver. During graphics hardware initialization on systems with GA100 chipsets, the driver fails to properly configure an internal security processor entry, leaving a required pointer unin…","severity":"medium","cvss":4.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-476","vendor":"Red Hat","product":"Linux","affected":["Linux >= 176fdcbddfd288408ce8571c1760ad618d962096 < f29267ace04283e76f92a74d9a7f4fcfcb32f484","Linux >= 176fdcbddfd288408ce8571c1760ad618d962096 < 604d0efb17cc0dd197e089134736ac2698d5fca7","Linux 6.7"],"published":"2026-10-23","updated":"2026-10-26","sourceUpdated":"2026-10-26T11:01:46+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98875.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98875.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98875"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559573"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98875"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98875"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98875.mbox"},{"url":"https://git.kernel.org/stable/c/f29267ace04283e76f92a74d9a7f4fcfcb32f484"},{"url":"https://git.kernel.org/stable/c/604d0efb17cc0dd197e089134736ac2698d5fca7"},{"url":"https://git.kernel.org/stable/c/feb1ad41281aed00e8a741942e56a1cd774e8342"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00161,"epssPercentile":0.05274,"ingestedAt":"2026-10-23T13:24:55.583Z","slug":"CVE-2026-98875","body":"## Overview\n\nA flaw was found in the Linux kernel's Nouveau GPU driver. During graphics hardware initialization on systems with GA100 chipsets, the driver fails to properly configure an internal security processor entry, leaving a required pointer uninitialized. A local user or process interacting with the graphics driver can trigger a null pointer dereference, crashing the kernel and resulting in a Denial of Service (DoS).\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98875.json)\n\n**kernel: drm/nouveau/gsp: add SEC2 to GA100 chip table** — rated Moderate by Red Hat. Released 2026-10-23, updated 2026-10-26.\n\nNot affected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nRefer to the advisory for fix availability.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":24.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":229316,"id":"CVE-2026-98875","ts":1793019682757,"field":"cvss","old":null,"new":"4.4"},{"seq":229315,"id":"CVE-2026-98875","ts":1793019682757,"field":"severity","old":"none","new":"medium"}]}