Executive brief
The Nouveau GPU driver in the Linux kernel contains a NULL pointer dereference bug in its virtual memory binding code. An unprivileged user with access to a GPU render node can trigger a kernel crash by submitting a crafted series of memory binding operations, causing a denial of service.
Technical details
The vulnerability is a NULL pointer dereference in the Nouveau DRM driver's UVMM (User Virtual Memory Manager) bind job submission path. During processing of OP_MAP_SPARSE operations, the op->ops field remains NULL for successfully processed sparse maps. If a subsequent operation in the same job fails, the error unwind loop unconditionally calls drm_gpuva_ops_free() on the NULL pointer, which immediately dereferences it in a list traversal, causing a kernel oops. The vulnerable code path is reachable by any render-node file descriptor holder via the DRM_RENDER_ALLOW NOUVEAU_VM_BIND ioctl. The fix guards the drm_gpuva_ops_free() call with IS_ERR_OR_NULL() check, matching existing cleanup code patterns. This was patched upstream in kernel commit 412a6ceb56d501ef2f8202e26ab4b5d4dfbca566.
Affected products
- Linux Linux kernel Multiple versions prior to fix commit 412a6ceb56d501ef2f8202e26ab4b5d4dfbca566
Timeline
- 2026-09-16: disclosed: Published in NVD
- 2026-09-11: patched: Kernel fix in stable tree
- 2026-08-11: other: Original commit by Zhenhao Wan