PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-98875 Linux CVE debrief

A Linux kernel vulnerability was resolved by adding SEC2 to the GA100 chip table in the drm/nouveau/gsp component. The vulnerability could cause a crash during GSP-RM boot due to a NULL device->sec2 dereference. This issue arises from the booter-load and booter-unload firmware running on the SEC2 falcon. During tu102_gsp_oneinit(), the booter constructor needs device->sec2 to access the SEC2 falcon. Without the .sec2 entry, device->sec2 is NULL, leading to a crash. The fix involves adding the SEC2 entry to the GA100 chip table.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-23
Original CVE updated
2026-10-26
Advisory published
2026-10-23
Advisory updated
2026-10-26

Who should care

Linux system administrators and security teams should verify kernel versions and assess exposure to this vulnerability. They should review system configurations for potential vulnerabilities and apply patches or updates from Linux vendors as available. This vulnerability affects Linux kernel deployments that use the drm/nouveau/gsp component. Security teams should prioritize verification of kernel versions and assessment of system configurations to ensure

Why it matters

Linux kernel vulnerability CVE-2026-98875 could cause a crash during GSP-RM boot. Verify kernel versions and assess exposure.

  • Verify Linux kernel versions to determine if exposure exists
  • Assess system configurations for potential vulnerabilities
  • Apply patches or updates from Linux vendors as available

Technical summary

The Linux kernel vulnerability CVE-2026-98875 was caused by a missing SEC2 entry in the GA100 chip table, leading to a NULL device->sec2 dereference during GSP-RM boot. The vulnerability has been resolved by adding the SEC2 entry. This fix ensures that the booter-load and booter-unload firmware can run on the SEC2 falcon without causing a crash. The official CVE Program record and NIST NVD detail page provide additional technical information on the vulnerability and its resolution. Linux system administrators and security teams should verify kernel versions and assess exposure to this vulnerability.

Defensive priority

Verify Linux kernel versions and assess exposure based on official sources

Recommended defensive actions

  • Verify Linux kernel versions to determine if exposure exists
  • Assess system configurations for potential vulnerabilities
  • Apply patches or updates from Linux vendors as available
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability and its resolution. However, the CVSS score and severity are not provided. The official CVE Program record and NIST NVD detail page offer additional information on the vulnerability. The source item provides details on the vulnerability, but its description is limited. To verify exposure, Linux system administrators and security teams should review kernel versions and assess system configurations.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-98875 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-98875

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-98875 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-98875

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • drm/nouveau/gsp: add SEC2 to GA100 chip table

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/98xxx/CVE-2026-98875.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f29267ace04283e76f92a74d9a7f4fcfcb32f484

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/604d0efb17cc0dd197e089134736ac2698d5fca7

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.