Linux Kernel nouveau EUVD-2026-28687

Three specific conditions must simultaneously hold for exploitation: (1) the system must use the nouveau kernel driver - systems using the proprietary NVIDIA driver are unaffected; (2) Linux runtime power management must be active and the GPU must be in a runtime-suspended state at the moment of the AUX access; (3) a process must initiate a DisplayPort AUX channel transfer via /dev/drm_dp_*, which in practice requires either root access or membership in the video/render group, or a setuid/setgid tool such as fwupd. Exploitation is further limited to NVIDIA GPUs supported by the r535 GSP firmware path (Turing-generation and later). The CVSS PR:L (low privilege required) rating reflects that access to /dev/drm_dp_* typically requires low but non-zero privilege. Server environments and systems using the proprietary NVIDIA driver are not affected.

Real-world risk is low-to-moderate for affected deployments. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects a local, low-complexity attack with low privilege requirements producing high availability impact - meaning any unprivileged local user who can reach /dev/drm_dp_* while the GPU is suspended can crash the kernel. The EPSS score of 0.02% (7th percentile) indicates very low probability of observed exploitation in the wild, consistent with the niche hardware and driver combination required. There is no KEV listing and no public proof-of-concept. The Lenovo hardware reference in the kernel trace and tags (Red Hat, SUSE, Lenovo) suggests this has been observed on real enterprise laptop hardware running Fedora/RHEL-family kernels. The practical blast radius is limited: it requires the nouveau driver (not the proprietary NVIDIA driver), runtime PM enabled, GPU in suspended state, and a tool or user actively probing DP AUX - conditions more likely on developer workstations and laptops than servers. CVSS availability rating of High is justified for a kernel crash, but the narrow trigger conditions keep actual exploitation probability low.

A local user on a Linux laptop or workstation with an NVIDIA GPU using the nouveau driver triggers the crash by running fwupd (or a similar tool that probes DisplayPort AUX channels) while the GPU has been runtime-suspended after a period of inactivity. The tool opens /dev/drm_dp_* and initiates an AUX transfer, the kernel routes the request into the GSP firmware messaging stack without first waking the device, and r535_gsp_msgq_wait fires a kernel WARNING that may result in a system hang or reboot depending on kernel panic configuration. No public proof-of-concept exists, but the bug was observed in production on a Lenovo ThinkPad running Fedora 43.