Executive brief
A vulnerability was identified in the Linux kernel's Nouveau graphics driver, which is used to support NVIDIA hardware. The flaw involves an error in how the system checks memory boundaries when processing graphics commands. If exploited, this could potentially allow a local user to bypass security checks, leading to system instability or unauthorized access to memory.
Technical details
An integer overflow exists in the nouveau_gem_pushbuf_reloc_apply() function within drivers/gpu/drm/nouveau/nouveau_gem.c. The vulnerability is caused by a 32-bit unsigned integer addition (r->reloc_bo_offset + 4) that can wrap around before being compared against the buffer object (BO) size (nvbo->bo.base.size). Because the offset is a __u32 and the literal 4 promotes to an unsigned int, the check fails to prevent relocations that point outside the intended buffer if the offset is near the maximum value of a 32-bit integer. This could be exploited by a local attacker with access to the DRM interface to achieve out-of-bounds memory access. The fix involves casting the offset to a u64 to ensure the addition is performed using 64-bit arithmetic.
Affected products
- Linux Linux Kernel All versions prior to the May 2026 patches
Timeline
- 2026-04-20: patched: Initial patch authored by Greg Kroah-Hartman
- 2026-05-27: disclosed: CVE-2026-46006 published
References
- https://git.kernel.org/stable/c/2fc87d37be1b730a149b035f9375fdb8cc5333a5
- https://git.kernel.org/stable/c/332884f5eb79dd60a7162b079d09d39208567a31
- https://git.kernel.org/stable/c/d749a9a0ee4014681487e7ae549901aa8c176637
- https://git.kernel.org/stable/c/e441d5c23ec644c8d27593db3b8928e8933512a9
- https://git.kernel.org/stable/c/fa297e919d1680c38ab268ff952b1698dac987f6