EUVD-2026-76464
GHSA-9qfh-2fg7-437p
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition requires precise concurrent timing between ioctl and close operations, warranting AC:H; local user with nouveau device node access needed (PR:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
nouveau/gem: reserve the bo in the info ioctl around the vma lookup
In the non-uvmm path, there could be a race between the info lookup finding the vma, and the gem close path closing the vma leading to a use-after-free.
Spotted with the help of Opus 4.6.
AnalysisAI
Use-after-free in the Linux kernel's nouveau open-source NVIDIA GPU driver allows a local unprivileged user to corrupt kernel memory via a race between the GEM buffer object info ioctl and a concurrent GEM close operation. In the non-uvmm code path, the VMA (virtual memory area mapping) associated with a buffer object can be freed by the close path between the info ioctl's lookup and its subsequent dereference, creating a classic use-after-free condition with potential for kernel-level code execution or privilege escalation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) a system running an NVIDIA GPU with the nouveau open-source kernel driver loaded - the proprietary nvidia.ko driver is not affected, and AMD/Intel GPU systems are unaffected; (2) the non-uvmm memory management code path (systems configured with uvmm are not affected); (3) a local user account with read/write access to the nouveau DRM device node (/dev/dri/cardX or /dev/dri/renderDX); (4) ability to execute concurrent threads or processes targeting the same GEM buffer object to win the race window between info ioctl VMA lookup and gem close VMA free. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS of 7.8 (AV:L/AC:L/PR:L) reflects local access and low privilege requirements, and the C:H/I:H/A:H impact accurately captures the theoretical severity of a kernel UAF. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Linux kernel to a patched stable release: 6.12.109 or later on the 6.12.x branch, 6.18.50 or later on the 6.18.x branch, or 7.2.4 or later on the 7.2.x branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems running the nouveau GPU driver to understand organizational exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today