Linux Kernel nouveau
CVE-2024-27062
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local user account on nouveau-driver system
-
DeliveryLaunch concurrent Vulkan/GPU workloads targeting same client context
-
ExploitRace concurrent VRAM BAR mapping operations on unlocked object tree
-
ExecutionDereference corrupted/freed client object pointer in nvkm_object_search
-
PersistTrigger kernel GPF crash or memory corruption
-
ImpactAchieve DoS or potential privilege escalation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires: (1) a system with an NVIDIA GPU actively using the nouveau kernel driver - systems using the proprietary nvidia.ko driver are entirely unaffected by this code path; (2) a local user account with read/write access to the GPU device nodes (/dev/dri/renderD* or equivalent); (3) the ability to launch concurrent GPU workloads that trigger VRAM BAR mapping (e.g., Vulkan or OpenGL applications) on the same GPU context simultaneously. The race window exists during concurrent nvif_object_map_handle calls sharing a client object tree. Limiting factors: this is strictly local (AV:L), requires GPU hardware presence, requires nouveau specifically (not the proprietary driver), and requires at least low-privilege system access (PR:L). Authentication requirements are confirmed as low-privileged local user based on the CVSS PR:L vector. |
| Impact | The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) represents a high-severity local privilege escalation scenario, but real-world prioritization is nuanced. The attack surface is narrowed to systems specifically running the nouveau driver with an NVIDIA GPU - environments using the proprietary nvidia.ko driver are unaffected. The AC:L rating from NVD is arguably optimistic for a race condition, which typically requires precise timing; however, the fact that deqp-vk (a conformance workload) reliably reproduces it suggests the race window is wide enough to be practically exploitable. EPSS at 0.17% (7th percentile) indicates no significant observed in-the-wild exploitation, consistent with the absence of a KEV listing. The C:H/I:H/A:H triad reflects the kernel-level impact: confirmed crash (A:H), potential kernel memory leak through corrupted pointer reads (C:H), and memory corruption (I:H). No POC exploit beyond the triggering workload is known. This is a genuine patching priority for any Linux system using nouveau, particularly multi-tenant or interactive user environments, but not an emergency for proprietary-driver shops. |
| Exploit ScenarioDerived | A local user with GPU device access (e.g., a shared workstation or multi-user Linux system with an NVIDIA GPU running the nouveau driver) launches concurrent Vulkan or OpenGL workloads that simultaneously trigger VRAM BAR mapping operations. The competing threads race on the unlocked client object tree, with one thread freeing a client object while another reads its pointer in nvkm_object_search. This produces a general protection fault - either crashing the kernel (DoS) or, in a more controlled exploitation attempt, potentially leaking kernel pointer values or corrupting kernel memory to escalate privileges. No purpose-built POC beyond the deqp-vk Vulkan conformance workload is publicly known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Aug 04, 2026
Race condition in the Linux kernel's nouveau (open-source NVIDIA) GPU driver allows a local low-privileged user to trigger kernel memory corruption, information disclosure, or a system crash by exploiting missing locking on the client object tree during concurrent VRAM BAR mapping operations. The crash trace confirms a general protection fault at nvkm_object_search triggered by deqp-vk (Vulkan workloads), reading a non-canonical kernel pointer (0x6677ed422bceb80c), indicating a use-after-free or corrupted pointer dereference. No public exploit code and no CISA KEV listing exist at time of analysis; the EPSS score of 0.17% (7th percentile) reflects low observed exploitation probability, but the local privilege escalation potential warrants patching on affected systems.
Earlier versions of this analysis (2)
Kernel memory corruption in the Linux nouveau driver (open-source NVIDIA GPU driver) stems from missing locking on the client object tree, enabling a local low-privileged user to trigger a race condition around VRAM BAR mapping operations and cause a general protection fault - with potential for privilege escalation to kernel context. Affected are Linux kernel versions through 6.8-rc6 on systems using the nouveau driver. No public exploit identified at time of analysis and EPSS is extremely low (0.17%, 7th percentile), though the demonstrated crash trace using the Vulkan test suite (deqp-vk) confirms the fault is reproducible under GPU-heavy concurrent workloads.
Concurrent VRAM BAR mapping operations in the Linux kernel's nouveau GPU driver trigger a race condition due to missing locking on the client object tree, causing kernel memory corruption via general protection fault. Linux kernel versions up to 6.8-rc6 running the open-source nouveau NVIDIA GPU driver are affected; systems using the proprietary NVIDIA driver are not exposed. A local low-privileged user capable of submitting concurrent GPU workloads can exploit this race to crash the kernel or potentially escalate privileges; no public exploit has been identified and EPSS stands at 0.17%, indicating minimal current exploitation activity.
RemediationAI
The primary fix is to apply one of the three upstream stable-tree patches available at https://git.kernel.org/stable/c/6887314f5356389fc219b8152e951ac084a10ef7, https://git.kernel.org/stable/c/96c8751844171af4b3898fee3857ee180586f589, or https://git.kernel.org/stable/c/b7cc4ff787a572edf2c55caeffaa88cd801eb135. The fix adds locking to the nvkm client object tree to serialize add/remove operations. Upstream fix is available via kernel stable commits; a specific tagged release version is not independently confirmed from the provided data - verify with your distribution's security tracker (Canonical, Red Hat, SUSE, etc.) for backport status and specific package versions. As a compensating control where patching is not immediately possible, restricting untrusted local users from accessing the GPU device node (/dev/dri/renderD* and /dev/dri/card*) via udev rules or group membership will prevent exploitation, at the cost of disabling GPU access for those users. Alternatively, loading the proprietary nvidia.ko driver in place of nouveau sidesteps this code path entirely, though this is a significant operational change.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The nouveau driver is the in-tree Linux kernel open-source driver for NVIDIA GPUs (cpe:2.3:o:linux:linux_kernel:*). The vulnerability (CWE-362: Race Condition) manifests in the nvkm client object tree - a kernel-internal data structure tracking GPU resource handles - which lacks mutex or RCU protection during concurrent add/remove operations. The crash trace shows the race path: a page fault during VRAM BAR memory mapping (nouveau_ttm_fault → ttm_bo_vm_fault_reserved → nouveau_ttm_io_mem_reserve → nvif_object_map_handle → nvkm_ioctl → nvkm_object_search). When two threads concurrently manipulate client objects, one thread can dereference a pointer that another thread has concurrently freed or invalidated, producing the observed non-canonical address fault at nvkm_object_search+0x1d. The affected kernel versions span through 6.8-rc6, confirmed by CPE data and the crash report on 6.8.0-rc6+.
Know when Canonical gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition requires concurrent timing (AC:H); local GPU device access with low-privileged user (AV:L/PR:L); confirmed kernel crash and memory corruption (C:H/I:H/A:H).
Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).
CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
nouveau: lock the client object tree.
It appears the client object tree has no locking unless I've missed something else. Fix races around adding/removing client objects, mostly vram bar mappings.
4562.099306] general protection fault, probably for non-canonical address 0x6677ed422bceb80c: 0000 [#1] PREEMPT SMP PTI [ 4562.099314] CPU: 2 PID: 23171 Comm: deqp-vk Not tainted 6.8.0-rc6+ #27 [ 4562.099324] Hardware name: Gigabyte Technology Co., Ltd. Z390 I AORUS PRO WIFI/Z390 I AORUS PRO WIFI-CF, BIOS F8 11/05/2021 [ 4562.099330] RIP: 0010:nvkm_object_search+0x1d/0x70 [nouveau] [ 4562.099503] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 48 89 f8 48 85 f6 74 39 48 8b 87 a0 00 00 00 48 85 c0 74 12 <48> 8b 48 f8 48 39 ce 73 15 48 8b 40 10 48 85 c0 75 ee 48 c7 c0 fe [ 4562.099506] RSP: 0000:ffffa94cc420bbf8 EFLAGS: 00010206 [ 4562.099512] RAX: 6677ed422bceb814 RBX: ffff98108791f400 RCX: ffff9810f26b8f58 [ 4562.099517] RDX: 0000000000000000 RSI: ffff9810f26b9158 RDI: ffff98108791f400 [ 4562.099519] RBP: ffff9810f26b9158 R08: 0000000000000000 R09: 0000000000000000 [ 4562.099521] R10: ffffa94cc420bc48 R11: 0000000000000001 R12: ffff9810f02a7cc0 [ 4562.099526] R13: 0000000000000000 R14: 00000000000000ff R15: 0000000000000007 [ 4562.099528] FS: 00007f629c5017c0(0000) GS:ffff98142c700000(0000) knlGS:0000000000000000 [ 4562.099534] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4562.099536] CR2: 00007f629a882000 CR3: 000000017019e004 CR4: 00000000003706f0 [ 4562.099541] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 4562.099542] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 4562.099544] Call Trace: [ 4562.099555] <TASK> [ 4562.099573] ? die_addr+0x36/0x90 [ 4562.099583] ? exc_general_protection+0x246/0x4a0 [ 4562.099593] ? asm_exc_general_protection+0x26/0x30 [ 4562.099600] ? nvkm_object_search+0x1d/0x70 [nouveau] [ 4562.099730] nvkm_ioctl+0xa1/0x250 [nouveau] [ 4562.099861] nvif_object_map_handle+0xc8/0x180 [nouveau] [ 4562.099986] nouveau_ttm_io_mem_reserve+0x122/0x270 [nouveau] [ 4562.100156] ? dma_resv_test_signaled+0x26/0xb0 [ 4562.100163] ttm_bo_vm_fault_reserved+0x97/0x3c0 [ttm] [ 4562.100182] ? __mutex_unlock_slowpath+0x2a/0x270 [ 4562.100189] nouveau_ttm_fault+0x69/0xb0 [nouveau] [ 4562.100356] __do_fault+0x32/0x150 [ 4562.100362] do_fault+0x7c/0x560 [ 4562.100369] __handle_mm_fault+0x800/0xc10 [ 4562.100382] handle_mm_fault+0x17c/0x3e0 [ 4562.100388] do_user_addr_fault+0x208/0x860 [ 4562.100395] exc_page_fault+0x7f/0x200 [ 4562.100402] asm_exc_page_fault+0x26/0x30 [ 4562.100412] RIP: 0033:0x9b9870 [ 4562.100419] Code: 85 a8 f7 ff ff 8b 8d 80 f7 ff ff 89 08 e9 18 f2 ff ff 0f 1f 84 00 00 00 00 00 44 89 32 e9 90 fa ff ff 0f 1f 84 00 00 00 00 00 <44> 89 32 e9 f8 f1 ff ff 0f 1f 84 00 00 00 00 00 66 44 89 32 e9 e7 [ 4562.100422] RSP: 002b:00007fff9ba2dc70 EFLAGS: 00010246 [ 4562.100426] RAX: 0000000000000004 RBX: 000000000dd65e10 RCX: 000000fff0000000 [ 4562.100428] RDX: 00007f629a882000 RSI: 00007f629a882000 RDI: 0000000000000066 [ 4562.100432] RBP: 00007fff9ba2e570 R08: 0000000000000000 R09: 0000000123ddf000 [ 4562.100434] R10: 0000000000000001 R11: 0000000000000246 R12: 000000007fffffff [ 4562.100436] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 4562.100446] </TASK> [ 4562.100448] Modules linked in: nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink cmac bnep sunrpc iwlmvm intel_rapl_msr intel_rapl_common snd_sof_pci_intel_cnl x86_pkg_temp_thermal intel_powerclamp snd_sof_intel_hda_common mac80211 coretemp snd_soc_acpi_intel_match kvm_intel snd_soc_acpi snd_soc_hdac_hda snd_sof_pci snd_sof_xtensa_dsp snd_sof_intel_hda_mlink ---truncated---
Executive ViewAI
CVE-2024-27062 affects the Linux kernel's nouveau NVIDIA GPU driver, enabling local low-privileged users to crash systems or disclose kernel memory through a race condition in concurrent GPU VRAM operations. With a 0.2% real-world exploitation probability and no active exploitation confirmed, the vulnerability poses a localized privilege escalation risk to environments with significant local user access or multi-tenant workloads.
Apply vendor patch. For systems with extended patching windows, disable the nouveau driver module if GPU support is not critical; restrict local user shell access to trusted administrators only; monitor system logs for GPU driver panics or segmentation faults during concurrent GPU workloads.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Affected Products (CPE)CVE.org
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
GitHub PoC
Exploit-DB