{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-89801", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.767Z", "datePublished": "2026-09-16T10:30:34.458Z", "dateUpdated": "2026-10-19T08:52:55.925Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:52:55.925Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE\n\nIn nouveau_uvmm_bind_job_submit()'s OP_UNMAP_SPARSE arm, op->reg is set\nfrom nouveau_uvma_region_find(), which only looks the region up and takes\nno reference; a region's sole reference is its membership in\nuvmm->region_mt. Two failure paths leave op->reg set: the -ENOENT check\nwhen the region is busy, and the drm_gpuvm_sm_unmap_ops_create() failure.\nThe sibling nouveau_uvmm_sm_unmap_prepare() failure just below clears\nop->reg; these two do not.\n\nunwind_continue steps back one op, so the failing op is skipped by the\nunwind loop and its op->reg stays set. nouveau_uvmm_bind_job_cleanup()\nthen enters its if (op->reg) branch and calls nouveau_uvma_region_remove()\nand nouveau_uvma_region_put() on it, dropping the tree's sole reference\nand freeing a region this job never created. The comment above the\ncleanup loop documents the broken invariant: op->reg must be NULL on\nsubmit failure.\n\nThis frees a live region on an unrelated failure, reachable single-job\nwhen drm_gpuvm_sm_unmap_ops_create() returns -ENOMEM; if another job owns\nthe same region, its cleanup then removes and puts the freed region, a\nuse-after-free. Clear op->reg on both failure paths." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is reached through DRM_IOCTL_NOUVEAU_VM_BIND on a nouveau render node (/dev/dri/renderD*): nouveau_uvmm_ioctl_vm_bind → nouveau_job_submit → nouveau_uvmm_bind_job_submit. This is a local ioctl path, not a network, adjacent-radio, or physical-bus interface.\nAC:L - An attacker can MAP_SPARSE a region, submit an async OP_UNMAP_SPARSE that dirties it while holding op->reg, then a second OP_UNMAP_SPARSE on the same range (or two unmaps in one ioctl). The failing path leaves op->reg set and cleanup frees the live region. The attacker drives both jobs, so no condition is outside their control.\nPR:L - NOUVEAU_VM_INIT and NOUVEAU_VM_BIND are DRM_RENDER_ALLOW with no DRM_ROOT_ONLY or capability checks. Any unprivileged local user who can open the nouveau render node (typical render/video group) can trigger this without init-namespace root.\nUI:N - The attacker opens their own DRM client and issues VM_INIT/VM_BIND ioctls on that fd; no separate victim action such as mounting a filesystem or opening an attacker-controlled file is required.\nS:U - The use-after-free corrupts kernel heap state (struct nouveau_uvma_region) inside the host nouveau driver. Impact stays in the same kernel authority; this is not a VM escape or IOMMU/DMA isolation bypass.\nC:H - Cleanup of a failed OP_UNMAP_SPARSE drops the maple-tree's sole reference and kfree()s a live nouveau_uvma_region another job still holds in op->reg. That use-after-free of a kernel object enables disclosure of reused slab contents, so confidentiality is High.\nI:H - The owning job's later cleanup calls sparse-unref, mas_erase, complete_all, and kref_put on the already-freed region. Heap spraying can reuse that object to corrupt kernel pointers and hijack control flow, so integrity is High.\nA:H - Dereferencing the freed nouveau_uvma_region in nouveau_uvmm_bind_job_cleanup, maple-tree remove, or a later bind causes a kernel oops/panic; the attacker can repeat the sequence to crash or hang the system." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/nouveau/nouveau_uvmm.c" ], "versions": [ { "version": "b88baab828713ce0b49b185444b2ee83bed373a8", "lessThan": "ba42d8a1c2c7629c61914df11a7d63ac77449ffb", "status": "affected", "versionType": "git" }, { "version": "b88baab828713ce0b49b185444b2ee83bed373a8", "lessThan": "88114e3a96582882e63b2f73aa7a5a9cf0d5073c", "status": "affected", "versionType": "git" }, { "version": "b88baab828713ce0b49b185444b2ee83bed373a8", "lessThan": "24c25b182d17d1bdfde0088c96bdf6f93e8f46bc", "status": "affected", "versionType": "git" }, { "version": "b88baab828713ce0b49b185444b2ee83bed373a8", "lessThan": "4083d24c2636fde7b18076115af52820d203bc57", "status": "affected", "versionType": "git" }, { "version": "b88baab828713ce0b49b185444b2ee83bed373a8", "lessThan": "ccf930812f23b8259ef64fd3394d53b093e4651a", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/nouveau/nouveau_uvmm.c" ], "versions": [ { "version": "6.6", "status": "affected" }, { "version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.110", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.51", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.5", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.157" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.12.110" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.18.51" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.2.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/ba42d8a1c2c7629c61914df11a7d63ac77449ffb" }, { "url": "https://git.kernel.org/stable/c/88114e3a96582882e63b2f73aa7a5a9cf0d5073c" }, { "url": "https://git.kernel.org/stable/c/24c25b182d17d1bdfde0088c96bdf6f93e8f46bc" }, { "url": "https://git.kernel.org/stable/c/4083d24c2636fde7b18076115af52820d203bc57" }, { "url": "https://git.kernel.org/stable/c/ccf930812f23b8259ef64fd3394d53b093e4651a" } ], "title": "drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE", "x_generator": { "engine": "bippy-1.2.0" } } } }