EUVD-2026-103755
GHSA-82rj-6xvq-73v7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access to nouveau DRM device
-
DeliveryOpen device triggering cli_init failure path
-
ExploitForce double nvif_vmm_dtor on vmm->page
-
ExecutionCorrupt kernel slab allocator state
-
ImpactEscalate privileges or crash kernel
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires the nouveau kernel driver to be loaded (a Linux host with Nvidia GPU using the open-source nouveau driver) and local access to the DRM device node (/dev/dri/*), typically gated by membership in the video group or equivalent. The specific trigger is reaching the cleanup path twice: nouveau_cli_init() must fail so that nouveau_cli_fini() is invoked once internally and then again by nouveau_drm_open()'s own error handling, double-freeing vmm->page because it is never cleared after the first kfree(). Limiting factors: the vector is local (not remote/network), low-privilege but not zero-privilege (device access needed), no user interaction of a victim is required, and hosts without the nouveau driver loaded (servers, cloud VMs, systems using the proprietary Nvidia driver) are not exposed. |
| Impact | This is a genuine but comparatively low-urgency memory-corruption flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) correctly reflects a local, low-privilege double-free with high confidentiality, integrity and availability impact - consistent with kernel heap corruption that can escalate to code execution or crash. All signals point the same way: EPSS is 0.21% (11th percentile), there is no CISA KEV listing, and no public exploit reference is present, so this is not evidence of widespread opportunistic exploitation. The vuln.today decision label is 'this_week' (patch promptly, not an emergency), which aligns with a local-only, authentication-requiring bug rather than a remotely-exploitable one. The practical risk is bounded by the local attack vector: an attacker already needs local code execution and access to the nouveau DRM device to reach the vulnerable path. Note one input inconsistency: the Tags list this as 'Information Disclosure', but the described defect is a double-free (memory corruption / potential use-after-free), which the CVSS C:H/I:H/A:H full-impact profile also reflects - treat the 'Information Disclosure' label as suspect. The flaw was discovered by Syzkaller fuzzing, which is a discovery method, not evidence of in-the-wild use. |
| Exploit ScenarioDerived | A local unprivileged user with access to the nouveau DRM device node opens /dev/dri/* and drives nouveau_drm_open() down the error path where nouveau_cli_init() fails, causing nouveau_cli_fini() - and thus nvif_vmm_dtor() - to run twice on the same vmm->page allocation. The resulting double-free corrupts kernel slab state, which a skilled attacker could shape toward local privilege escalation or, at minimum, a denial-of-service kernel crash. No public exploit is identified; the issue was reproduced via a modified Syzkaller, and the local low-complexity vector makes reliable triggering plausible. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 24, 2026
Double-free in the Linux kernel's nouveau open-source DRM driver lets a local user who can open the DRM device node corrupt kernel heap memory by forcing the driver's client-teardown path to run twice during a failed open. Only hosts that actually have the nouveau module loaded are exposed - typically desktops, workstations or VMs with an NVIDIA GPU bound to nouveau rather than the proprietary driver - and the CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact) reflects a local, low-privilege attacker with device access, not a remote one. The flaw has been fixed upstream in the stable trees, no public exploit code has been identified at time of analysis, and EPSS is low at 0.21% (11th percentile), which is consistent with a priority of patching this week rather than an emergency response.
RemediationAI
Apply the vendor-released kernel updates: 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.55, 7.2.9 or 7.3-rc5, or take the corresponding stable commit from git.kernel.org (for example https://git.kernel.org/stable/c/bf542ecd4f60d4689818d194e7ca74772fe0f8b5 for one of the affected branches) and rebuild; distributions carrying these trees should ship the backport through their normal kernel advisory channel. Because the bug is only reachable through nouveau's error path and requires the driver to be loaded plus local access to /dev/dri/*, hosts that do not need the open-source NVIDIA driver can blacklist or unload nouveau (modprobe.blacklist=nouveau), which removes the attack surface entirely at the cost of losing GPU acceleration on that device. Tightening ownership and permissions on /dev/dri render and card nodes so that only trusted, already-privileged groups can open them reduces exposure for multi-user systems, though it does not fix the double-free and does not protect privileged users, who can reach the node regardless. Systems using NVIDIA's proprietary driver are not affected by this code path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
nouveau is the in-tree, reverse-engineered DRM/KMS driver for NVIDIA GPUs, and its user-space-facing objects are managed through the nvif layer. During nouveau_cli_init(), the driver allocates a page for the VMM via nvif_vmm_ctor() and stores it in vmm->page. nvif_vmm_dtor() frees that page with kfree() unconditionally but never clears vmm->page afterwards, so the structure is left holding a dangling pointer. The bug is in the error-handling flow rather than in normal operation: when nouveau_cli_init() fails, it calls nouveau_cli_fini(), which calls nouveau_vmm_fini() and then nvif_vmm_dtor(); nouveau_drm_open() then enters its own cleanup path and calls nouveau_cli_fini() a second time, freeing the same vmm->page again. The defect is therefore a classic double-free (the double-free/CWE-415 class; the CVE feed itself carries no CWE assignment), triggered specifically on the driver-open error path rather than through a crafted ioctl. It was discovered by fuzzing nouveau with a modified Syzkaller, and the KASAN report shows kfree() on an already-freed address in nvif_vmm_dtor at drivers/gpu/drm/nouveau/nvif/vmm.c with the allocation originating in nvif_vmm_ctor(). CPE data maps the issue to the linux:linux product family; the practical attack surface is the local /dev/dri/* character device, reachable only when the nouveau module is bound to hardware.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local DRM device access required so AV:L and PR:L; the failure path is reachable without special timing per the report, so AC:L; kernel heap corruption yields full C/I/A impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau: fix double-free in nvif_vmm_dtor
On failure, nouveau_cli_init() calls nouveau_cli_fini() to tear the client down. Then, nouveau_drm_open() also enters into its cleanup path and calls nouveau_cli_fini() AGAIN. nouveau_cli_fini() calls nouveau_vmm_fini():
void nouveau_vmm_fini(struct nouveau_vmm *vmm) { nouveau_svmm_fini(&vmm->svmm); nvif_vmm_dtor(&vmm->vmm); vmm->cli = NULL; }
Inside nvif_vmm_dtor(), vmm->page is freed unconditionally:
void nvif_vmm_dtor(struct nvif_vmm *vmm) { kfree(vmm->page); nvif_object_dtor(&vmm->object); }
vmm->page is never cleared after being freed, so the second call of nvif_vmm_dtor() will cause a double-free.
Found by fuzzing the nouveau driver with a modified Syzkaller:
BUG: KASAN: double-free in nvif_vmm_dtor+0x31/0x50 drivers/gpu/drm/nouveau/nvif/vmm.c:194 Free of addr ffff888010fcdc30 by task syz.0.173/2567
CPU: 1 UID: 0 PID: 2567 Comm: syz.0.173 Not tainted 7.2.0 #24 PREEMPT(lazy) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x95/0xe0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcb/0x5a0 mm/kasan/report.c:482 kasan_report_invalid_free+0xaa/0xd0 mm/kasan/report.c:557 check_slab_allocation+0xe4/0x110 mm/kasan/common.c:235 kasan_slab_pre_free include/linux/kasan.h:199 [inline] slab_free_hook mm/slub.c:2622 [inline] slab_free mm/slub.c:6377 [inline] kfree+0x192/0x590 mm/slub.c:6692 nvif_vmm_dtor+0x31/0x50 drivers/gpu/drm/nouveau/nvif/vmm.c:194 nouveau_vmm_fini+0x16/0x50 drivers/gpu/drm/nouveau/nouveau_vmm.c:127 nouveau_cli_fini+0x10e/0x210 drivers/gpu/drm/nouveau/nouveau_drm.c:225 nouveau_drm_open+0x24e/0x740 drivers/gpu/drm/nouveau/nouveau_drm.c:1255 drm_file_alloc+0x5f2/0xad0 drivers/gpu/drm/drm_file.c:176 drm_open_helper+0x1d7/0x4a0 drivers/gpu/drm/drm_file.c:335 drm_open+0x190/0x3d0 drivers/gpu/drm/drm_file.c:388 drm_stub_open+0x1f2/0x460 drivers/gpu/drm/drm_drv.c:1211 chrdev_open+0x21c/0x660 fs/char_dev.c:411 do_dentry_open+0x59d/0x12b0 fs/open.c:947 vfs_open+0x82/0x390 fs/open.c:1052 do_open fs/namei.c:4700 [inline] path_openat+0x2345/0x3420 fs/namei.c:4863 do_file_open+0x207/0x460 fs/namei.c:4892 do_sys_openat2+0xd1/0x1d0 fs/open.c:1368 do_sys_open fs/open.c:1374 [inline] __do_sys_openat fs/open.c:1390 [inline] __se_sys_openat fs/open.c:1385 [inline] __x64_sys_openat+0x144/0x200 fs/open.c:1385 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x690 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc6d687594d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fc6d5295008 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007fc6d6b06180 RCX: 00007fc6d687594d RDX: 0000000000022501 RSI: 0000200000000000 RDI: ffffffffffffff9c RBP: 00007fc6d691c303 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fc6d6b06218 R14: 00007fc6d6b06180 R15: 00007ffd9451d760 </TASK>
Allocated by task 2567 on cpu 1 at 163.593900s: kasan_save_stack+0x24/0x50 mm/kasan/common.c:57 kasan_save_track+0x17/0x60 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5334 [inline] __kmalloc_noprof+0x304/0x7c0 mm/slub.c:5359 _kmalloc_noprof include/linux/slab.h:992 [inline] nvif_vmm_ctor+0x3c0/0x7e0 drivers/gpu/drm/nouveau/nvif/vmm.c:237 nouveau_vmm_init+0x40/0x90 drivers/gpu/drm/nouveau/nouveau_vmm.c:134 nouveau_cli_init+0x7b9/0 ---truncated---
Executive ViewAI
A high-severity double-free vulnerability in the Linux kernel's nouveau open-source graphics driver could allow a local attacker to corrupt kernel memory, leading to potential privilege escalation or system instability on affected systems. This impacts only workstations, desktops, or virtual machines using NVIDIA GPUs with the nouveau driver, not servers with proprietary drivers. Leadership should prioritize patching within the week to mitigate risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB