CVE-2026-98875None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: drm/nouveau/gsp: add SEC2 to GA100 chip table The booter-load and booter-unload firmware run on the SEC2 falcon. During tu102_gsp_oneinit(), the booter constructor nee…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau/gsp: add SEC2 to GA100 chip table
The booter-load and booter-unload firmware run on the SEC2 falcon. During tu102_gsp_oneinit(), the booter constructor needs device->sec2 to access the SEC2 falcon.
Without the .sec2 entry, device->sec2 is NULL and this dereference crashes during GSP-RM boot.
Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < feb1ad41281aed00e8a741942e56a1cd774e8342Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f29267ace04283e76f92a74d9a7f4fcfcb32f484Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 604d0efb17cc0dd197e089134736ac2698d5fca7Linux < 6.6.158Linux < 6.18.53Linux (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99001Nonedrm/xe/i2c: cancel the client work on remove
CVE-2026-98989Nonenamespace: check a recursive bind mount for mount namespace loops
CVE-2026-98988Nonenamespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-98992Nonenamespace: don't copy an unmounted mount tree
CVE-2026-98991Nonenamespace: queue a mount only once for mount notifications
CVE-2026-98990Nonenamespace: check a submount for references right before unmounting it