Executive brief
The Linux kernel's Nouveau graphics driver has a use-after-free vulnerability in how GPU channels are destroyed. When a channel is torn down on Fermi and newer NVIDIA GPUs, a race condition allows an event handler to access memory that has already been freed, potentially causing a system crash or enabling a local attacker to execute code with kernel privileges.
Technical details
The vulnerability is a use-after-free (CWE-416) in the Nouveau DRM driver's channel teardown path (nouveau_channel_del). The root cause is an ordering bug: the function frees the fence context first via context_del(), then later unsubscribes from the channel-kill event. If a kill event arrives during this window, the event handler nouveau_channel_killed() dereferences the already-freed fence context, taking locks and walking freed data structures. The vulnerability is gated on FERMI_CHANNEL_GPFIFO, so it affects Fermi-era and newer NVIDIA GPUs. Attack preconditions include local access and the precise timing of a channel kill event during destruction. The fix reorders the teardown to unsubscribe from the kill event before freeing any dependent structures.
Affected products
- Linux Linux kernel Fermi-era and newer (affected by subscription gating on FERMI_CHANNEL_GPFIFO)
Timeline
- 2026-09-16: disclosed: Published to NVD
- 2026-08-20: patched: Upstream fix merged by Lyude Paul
- 2026-09-11: patched: Stable kernel patch by Greg Kroah-Hartman