Executive brief
A vulnerability in the Linux kernel's NVIDIA graphics driver (nouveau) could allow a local user to crash the system. The issue occurs when software attempts to communicate with a DisplayPort device while the graphics hardware is in a low-power sleep state. This results in a system crash (kernel panic) rather than a standard error message, potentially leading to a denial of service.
Technical details
A vulnerability exists in the nouveau driver's DPCD (DisplayPort Configuration Data) implementation within the Linux kernel. When the GPU is in a runtime suspended state, attempts by userspace to access /dev/drm_dp_* trigger AUX transfers that the GSP (GPU System Processor) firmware code cannot handle, leading to a kernel crash in r535_gsp_msgq_wait. The fix introduces a check using pm_runtime_suspended() in nouveau_connector_aux_xfer to return -EBUSY instead of proceeding with the transfer. This is a local denial-of-service vulnerability requiring low privileges to trigger via standard DRM device nodes.
Affected products
- Linux Linux Kernel 3.16 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1, 7.0-rc2
Timeline
- 2026-02-24: disclosed: Initial patch authored by Dave Airlie
- 2026-05-08: advisory: CVE-2026-43381 published by kernel.org
- 2026-05-26: other: NVD analysis completed
References
- https://git.kernel.org/stable/c/178df7c91e6c202579284df9f79d1592a514cdcf
- https://git.kernel.org/stable/c/24639553a016578222ac597db924dfb6fa5ec8b5
- https://git.kernel.org/stable/c/4df518aa196085909fd7e32518ecd27fba60ed69
- https://git.kernel.org/stable/c/6bdd2d70c338d52c387d3b3aadc596784ae81b01
- https://git.kernel.org/stable/c/8f3c6f08ababad2e3bdd239728cf66a9949446b4
- https://git.kernel.org/stable/c/ad8fa5bff53f5d1f8394f996850da8ce070eaee3
- https://git.kernel.org/stable/c/cd24cab2023aa46b595bc6b9cc39d8973d9d0a8c