CVE-2026-98623

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update

If list_for_each_entry() exits without hitting a break then "pstate" is not a valid pstate pointer. Introduce a "found" variable instead.

The check is reachable from userspace: nvkm_clk_ustate_update() takes the pstate id straight from the 'pstate' debugfs file, so requesting an id that is not in clk->states - or any id at all when the perf tables are broken and the list is empty - makes the pstate->pstate != req test dereference the list head cast to a struct nvkm_pstate, which is an out-of-bounds read.

[Francesco: rebased on drm-misc-next, expanded the commit message]