{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89801", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.767Z", "datePublished": "2026-09-16T10:30:34.458Z", "dateUpdated": "2026-09-16T14:38:47.092Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-16T14:38:47.092Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE\n\nIn nouveau_uvmm_bind_job_submit()'s OP_UNMAP_SPARSE arm, op->reg is set\nfrom nouveau_uvma_region_find(), which only looks the region up and takes\nno reference; a region's sole reference is its membership in\nuvmm->region_mt. Two failure paths leave op->reg set: the -ENOENT check\nwhen the region is busy, and the drm_gpuvm_sm_unmap_ops_create() failure.\nThe sibling nouveau_uvmm_sm_unmap_prepare() failure just below clears\nop->reg; these two do not.\n\nunwind_continue steps back one op, so the failing op is skipped by the\nunwind loop and its op->reg stays set. nouveau_uvmm_bind_job_cleanup()\nthen enters its if (op->reg) branch and calls nouveau_uvma_region_remove()\nand nouveau_uvma_region_put() on it, dropping the tree's sole reference\nand freeing a region this job never created. The comment above the\ncleanup loop documents the broken invariant: op->reg must be NULL on\nsubmit failure.\n\nThis frees a live region on an unrelated failure, reachable single-job\nwhen drm_gpuvm_sm_unmap_ops_create() returns -ENOMEM; if another job owns\nthe same region, its cleanup then removes and puts the freed region, a\nuse-after-free. Clear op->reg on both failure paths."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached through DRM_IOCTL_NOUVEAU_VM_BIND on a nouveau render node (/dev/dri/renderD*): nouveau_uvmm_ioctl_vm_bind \u2192 nouveau_job_submit \u2192 nouveau_uvmm_bind_job_submit. This is a local ioctl path, not a network, adjacent-radio, or physical-bus interface.\nAC:L - An attacker can MAP_SPARSE a region, submit an async OP_UNMAP_SPARSE that dirties it while holding op->reg, then a second OP_UNMAP_SPARSE on the same range (or two unmaps in one ioctl). The failing path leaves op->reg set and cleanup frees the live region. The attacker drives both jobs, so no condition is outside their control.\nPR:L - NOUVEAU_VM_INIT and NOUVEAU_VM_BIND are DRM_RENDER_ALLOW with no DRM_ROOT_ONLY or capability checks. Any unprivileged local user who can open the nouveau render node (typical render/video group) can trigger this without init-namespace root.\nUI:N - The attacker opens their own DRM client and issues VM_INIT/VM_BIND ioctls on that fd; no separate victim action such as mounting a filesystem or opening an attacker-controlled file is required.\nS:U - The use-after-free corrupts kernel heap state (struct nouveau_uvma_region) inside the host nouveau driver. Impact stays in the same kernel authority; this is not a VM escape or IOMMU/DMA isolation bypass.\nC:H - Cleanup of a failed OP_UNMAP_SPARSE drops the maple-tree's sole reference and kfree()s a live nouveau_uvma_region another job still holds in op->reg. That use-after-free of a kernel object enables disclosure of reused slab contents, so confidentiality is High.\nI:H - The owning job's later cleanup calls sparse-unref, mas_erase, complete_all, and kref_put on the already-freed region. Heap spraying can reuse that object to corrupt kernel pointers and hijack control flow, so integrity is High.\nA:H - Dereferencing the freed nouveau_uvma_region in nouveau_uvmm_bind_job_cleanup, maple-tree remove, or a later bind causes a kernel oops/panic; the attacker can repeat the sequence to crash or hang the system."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/nouveau/nouveau_uvmm.c"], "versions": [{"version": "b88baab828713ce0b49b185444b2ee83bed373a8", "lessThan": "ba42d8a1c2c7629c61914df11a7d63ac77449ffb", "status": "affected", "versionType": "git"}, {"version": "b88baab828713ce0b49b185444b2ee83bed373a8", "lessThan": "88114e3a96582882e63b2f73aa7a5a9cf0d5073c", "status": "affected", "versionType": "git"}, {"version": "b88baab828713ce0b49b185444b2ee83bed373a8", "lessThan": "24c25b182d17d1bdfde0088c96bdf6f93e8f46bc", "status": "affected", "versionType": "git"}, {"version": "b88baab828713ce0b49b185444b2ee83bed373a8", "lessThan": "4083d24c2636fde7b18076115af52820d203bc57", "status": "affected", "versionType": "git"}, {"version": "b88baab828713ce0b49b185444b2ee83bed373a8", "lessThan": "ccf930812f23b8259ef64fd3394d53b093e4651a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/nouveau/nouveau_uvmm.c"], "versions": [{"version": "6.6", "status": "affected"}, {"version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.110", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.51", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.5", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.12.110"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.18.51"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.2.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.3-rc2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ba42d8a1c2c7629c61914df11a7d63ac77449ffb"}, {"url": "https://git.kernel.org/stable/c/88114e3a96582882e63b2f73aa7a5a9cf0d5073c"}, {"url": "https://git.kernel.org/stable/c/24c25b182d17d1bdfde0088c96bdf6f93e8f46bc"}, {"url": "https://git.kernel.org/stable/c/4083d24c2636fde7b18076115af52820d203bc57"}, {"url": "https://git.kernel.org/stable/c/ccf930812f23b8259ef64fd3394d53b093e4651a"}], "title": "drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/nouveau/nouveau_uvmm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ba42d8a1c2c7629c61914df11a7d63ac77449ffb", "status": "affected", "version": "b88baab828713ce0b49b185444b2ee83bed373a8", "versionType": "git"}, {"lessThan": "88114e3a96582882e63b2f73aa7a5a9cf0d5073c", "status": "affected", "version": "b88baab828713ce0b49b185444b2ee83bed373a8", "versionType": "git"}, {"lessThan": "24c25b182d17d1bdfde0088c96bdf6f93e8f46bc", "status": "affected", "version": "b88baab828713ce0b49b185444b2ee83bed373a8", "versionType": "git"}, {"lessThan": "4083d24c2636fde7b18076115af52820d203bc57", "status": "affected", "version": "b88baab828713ce0b49b185444b2ee83bed373a8", "versionType": "git"}, {"lessThan": "ccf930812f23b8259ef64fd3394d53b093e4651a", "status": "affected", "version": "b88baab828713ce0b49b185444b2ee83bed373a8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/nouveau/nouveau_uvmm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"lessThan": "6.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.110", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.51", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE\n\nIn nouveau_uvmm_bind_job_submit()'s OP_UNMAP_SPARSE arm, op->reg is set\nfrom nouveau_uvma_region_find(), which only looks the region up and takes\nno reference; a region's sole reference is its membership in\nuvmm->region_mt. Two failure paths leave op->reg set: the -ENOENT check\nwhen the region is busy, and the drm_gpuvm_sm_unmap_ops_create() failure.\nThe sibling nouveau_uvmm_sm_unmap_prepare() failure just below clears\nop->reg; these two do not.\n\nunwind_continue steps back one op, so the failing op is skipped by the\nunwind loop and its op->reg stays set. nouveau_uvmm_bind_job_cleanup()\nthen enters its if (op->reg) branch and calls nouveau_uvma_region_remove()\nand nouveau_uvma_region_put() on it, dropping the tree's sole reference\nand freeing a region this job never created. The comment above the\ncleanup loop documents the broken invariant: op->reg must be NULL on\nsubmit failure.\n\nThis frees a live region on an unrelated failure, reachable single-job\nwhen drm_gpuvm_sm_unmap_ops_create() returns -ENOMEM; if another job owns\nthe same region, its cleanup then removes and puts the freed region, a\nuse-after-free. Clear op->reg on both failure paths."}], "id": "CVE-2026-89801", "lastModified": "2026-09-16T11:16:44.997", "metrics": {}, "published": "2026-09-16T11:16:44.997", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/24c25b182d17d1bdfde0088c96bdf6f93e8f46bc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4083d24c2636fde7b18076115af52820d203bc57"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/88114e3a96582882e63b2f73aa7a5a9cf0d5073c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ba42d8a1c2c7629c61914df11a7d63ac77449ffb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ccf930812f23b8259ef64fd3394d53b093e4651a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{}