drm/gma500: return errors from Oaktrail HDMI I2C reads
In the Linux kernel, the following vulnerability has been resolved: drm/gma500: return errors from Oaktrail HDMI I2C reads xfer_read() waits for the HDMI I2C transaction to reach I2C_TRANSACTION_DONE, but it ignores both timeout and signal returns from wait_for_completion_interruptible_timeout(). If the interrupt never advances the transaction state, the loop can wait forever. Return -ETIMEDOUT when the completion wait expires, propagate interrupted waits, and make the I2C master_xfer callback return the first transfer error instead of reporting a successful message count.
- Products
- Linux
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-98886
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 29 Oct 2026, 18:03 UTC · Revision 2
Source evidence
drm/gma500: return errors from Oaktrail HDMI I2C reads
core-cve · Original sourcePublished 23 Oct 2026, 11:37 UTC
In the Linux kernel, the following vulnerability has been resolved: drm/gma500: return errors from Oaktrail HDMI I2C reads xfer_read() waits for the HDMI I2C transaction to reach I2C_TRANSACTION_DONE, but it ignores both timeout and signal returns from wait_for_completion_interruptible_timeout(). If the interrupt never advances the transaction state, the loop can wait forever. Return -ETIMEDOUT when the completion wait expires, propagate interrupted waits, and make the I2C master_xfer callback return the first transfer error instead of reporting a successful message count.
cve:CVE-2026-98886
Linux
Fixed versions: Not specified
Linux
Fixed versions: Not specified
Complete source record
{
"id": "0ee9857cedc50fe6d963e6aa4ce20c71adad9a8b18238f960ae43472fdbc111b",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98886",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "drm/gma500: return errors from Oaktrail HDMI I2C reads",
"summary": "In the Linux kernel, the following vulnerability has been resolved: drm/gma500: return errors from Oaktrail HDMI I2C reads xfer_read() waits for the HDMI I2C transaction to reach I2C_TRANSACTION_DONE, but it ignores both timeout and signal returns from wait_for_completion_interruptible_timeout(). If the interrupt never advances the transaction state, the loop can wait forever. Return -ETIMEDOUT when the completion wait expires, propagate interrupted waits, and make the I2C master_xfer callback return the first transfer error instead of reporting a successful message count.",
"evidence": "cve:CVE-2026-98886",
"products": [
{
"name": {
"value": "Linux",
"evidence": "/containers/cna/affected/0/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Linux",
"evidence": "/containers/cna/affected/1/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2026-98886",
"aliases": [
"CVE-2026-98886"
],
"metrics": [],
"affected": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "1e585b52fd8ea59792634bc31d227eb3456af22e",
"lessThan": "09a950950e7e4e74e021e60941c8e816ef1b4f71",
"versionType": "git"
},
{
"status": "affected",
"version": "1e585b52fd8ea59792634bc31d227eb3456af22e",
"lessThan": "898d209157fe2a245f7d9fe28c5921037d8b5033",
"versionType": "git"
},
{
"status": "affected",
"version": "1e585b52fd8ea59792634bc31d227eb3456af22e",
"lessThan": "15c6d7f7127a53b7312232178ecf03e5850161d2",
"versionType": "git"
},
{
"status": "affected",
"version": "1e585b52fd8ea59792634bc31d227eb3456af22e",
"lessThan": "8add43887cca1fe11a0ded62199ce726901d3f20",
"versionType": "git"
},
{
"status": "affected",
"version": "1e585b52fd8ea59792634bc31d227eb3456af22e",
"lessThan": "f85e8224bd4e1a0939cbfe13a6220fbddf61127c",
"versionType": "git"
},
{
"status": "affected",
"version": "1e585b52fd8ea59792634bc31d227eb3456af22e",
"lessThan": "c268df0653ab07bafc3d191e74ea097e3d9b9e69",
"versionType": "git"
},
{
"status": "affected",
"version": "1e585b52fd8ea59792634bc31d227eb3456af22e",
"lessThan": "9b5ce5c496efd20c1c662cedba88465d39ec1f93",
"versionType": "git"
}
],
"programFiles": [
"drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.1"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c"
],
"defaultStatus": "affected"
}
],
"modified": "2026-10-26T06:56:10.643Z",
"provider": "cve",
"references": [
"https://git.kernel.org/stable/c/09a950950e7e4e74e021e60941c8e816ef1b4f71",
"https://git.kernel.org/stable/c/898d209157fe2a245f7d9fe28c5921037d8b5033",
"https://git.kernel.org/stable/c/15c6d7f7127a53b7312232178ecf03e5850161d2",
"https://git.kernel.org/stable/c/8add43887cca1fe11a0ded62199ce726901d3f20",
"https://git.kernel.org/stable/c/f85e8224bd4e1a0939cbfe13a6220fbddf61127c",
"https://git.kernel.org/stable/c/c268df0653ab07bafc3d191e74ea097e3d9b9e69",
"https://git.kernel.org/stable/c/9b5ce5c496efd20c1c662cedba88465d39ec1f93"
],
"provider_metadata": {
"cna": {
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux",
"dateUpdated": "2026-10-26T06:56:10.643Z"
}
}
},
"related_cves": [
{
"value": "CVE-2026-98886",
"evidence": "/cveMetadata/cveId"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-cve",
"document_id": 263344,
"published_at": "2026-10-23T11:37:43.338+00:00"
}