Executive brief
The Nouveau GPU driver in the Linux kernel contains a memory management bug in its virtual memory binding operation. When certain memory unmapping operations fail, the driver incorrectly frees GPU memory regions that may still be in use by other jobs, leading to use-after-free conditions. This can allow a local attacker to corrupt kernel memory or execute arbitrary code with kernel privileges.
Technical details
A use-after-free vulnerability exists in nouveau_uvmm_bind_job_submit() when handling OP_UNMAP_SPARSE operations. The vulnerable code fails to clear the op->reg pointer on two error paths: when drm_gpuvm_sm_unmap_ops_create() fails or when a region is found to be busy (dirty). The cleanup handler then incorrectly processes the failed operation, calling nouveau_uvma_region_remove() and nouveau_uvma_region_put() on a region this job never created, releasing the sole reference held by uvmm->region_mt and freeing a live region. If another concurrent job owns the same region, its cleanup will attempt to use the freed region structure. The vulnerability is reachable through a single -ENOMEM allocation failure. The fix clears op->reg on both failure paths to maintain the documented invariant that op->reg must be NULL on submit failure.
Affected products
- Linux Linux kernel 5.x, 6.x, 7.x (drm/nouveau driver affected from b88baab82871 onwards)
Timeline
- 2026-09-16: disclosed: Published on NVD
- 2026-09-11: patched: Fix commit ccf930812f23b8259ef64fd3394d53b093e4651a merged upstream