In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau/clk: fix list cursor use after loop in nvkm clk ustate update

If list for each entry() exits without hitting a break then "pstate" is not a valid pstate pointer. Introduce a "found" variable instead.

The check is reachable from userspace: nvkm clk ustate update() takes the pstate id straight from the 'pstate' debugfs file, so requesting an id that is not in clk->states - or any id at all when the perf tables are broken and the list is empty - makes the pstate->pstate != req test dereference the list head cast to a struct nvkm pstate, which is an out-of-bounds read.

[Francesco: rebased on drm-misc-next, expanded the commit message]