Executive brief
A flaw in the Nouveau GPU driver's virtual memory management can leave memory regions in a corrupt state when sparse unmapping operations fail. Once corrupted, affected memory ranges become permanently unusable for the lifetime of the graphics device, causing subsequent operations to hang indefinitely or fail with cryptic errors.
Technical details
The vulnerability is a state management bug in the OP_UNMAP_SPARSE operation handler within drm/nouveau/nouveau_uvmm.c. When a sparse unmap succeeds, the dirty flag is set on the memory region and teardown is deferred. If a subsequent operation in the same batch job fails and triggers unwinding, the unwind path fails to clear the dirty flag before reverting the sparse unmap. This leaves the region in the memory tree with dirty=true, causing the completion signal never to fire. Subsequent bind operations over that range permanently fail with -ENOENT or -EINVAL errors, or hang in wait_for_completion(), rendering the memory region unusable for the lifetime of the UVMM object. The fix is a single-line addition to clear reg->dirty during unwind of OP_UNMAP_SPARSE. No authentication or network reachability is required; any user who submits a GPU job that triggers the unwind path can trigger this bug.
Affected products
- Linux Linux kernel v5.12 and later (introduced by commit b88baab82871)
Timeline
- 2026-09-16: disclosed: CVE-2026-89800 published
- 2026-09-11: patched: Patch merged into stable kernel tree
- 2026-08-11: other: Fix authored