Skip to main content

Linux Kernel EUVDEUVD-2026-35433

| CVE-2026-52904 MEDIUM
Memory Leak (CWE-401)
2026-06-09 Linux GHSA-h586-h5c7-xhhh
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local vector and low privileges required to trigger driver probe path; no confidentiality or integrity impact - resource leak causes availability loss only.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
2.3 LOW
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 08, 2026 - 22:37 vuln.today
CVSS changed
Jul 08, 2026 - 21:52 NVD
5.5 (MEDIUM)
Patch available
Jun 09, 2026 - 15:01 EUVD
CVE Published
Jun 09, 2026 - 12:36 nvd
UNKNOWN (no severity yet)
CVE Published
Jun 09, 2026 - 12:36 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: fix nvkm_device leak on aperture removal failure

When aperture_remove_conflicting_pci_devices() fails during probe, the error path returns directly without unwinding the nvkm_device that was just allocated by nvkm_device_pci_new(). This leaks both the device wrapper and the pci_enable_device() reference taken inside it.

Jump to the existing fail_nvkm label so nvkm_device_del() runs and balances both. The leak was introduced when the intermediate nvkm_device_del() between detection and aperture removal was dropped in favor of creating the pci device once.

AnalysisAI

Memory leak in the Linux kernel's drm/nouveau subsystem exposes systems with NVIDIA GPUs using the open-source nouveau driver to local denial of service. When aperture_remove_conflicting_pci_devices() fails during PCI device probe, the error path bypasses the fail_nvkm cleanup label, permanently leaking both the nvkm_device wrapper and the pci_enable_device() reference taken inside nvkm_device_pci_new(). No public exploit exists and EPSS sits at the 5th percentile (0.02%), confirming negligible exploitation probability; however, patched stable releases are available across multiple kernel branches.

Technical ContextAI

The vulnerability resides in the Direct Rendering Manager (DRM) nouveau driver - the open-source Linux kernel driver for NVIDIA GPUs, backed by the NVIDIA Kernel Mode (nvkm) abstraction layer. During PCI device probe, nvkm_device_pci_new() allocates a device wrapper struct and internally calls pci_enable_device() to claim the PCI resource. A subsequent call to aperture_remove_conflicting_pci_devices() resolves framebuffer aperture conflicts with other drivers. When that call returns an error, the original code returned directly rather than jumping to the existing fail_nvkm label - which would have invoked nvkm_device_del() to release both the wrapper and the PCI reference. The root cause is CWE-401 (Missing Release of Memory after Effective Lifetime), introduced when an intermediate nvkm_device_del() between detection and aperture removal was removed in favor of a single PCI device creation path. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

The primary fix is to upgrade to a patched Linux kernel release: 6.12.86 (stable 6.12 branch), 6.18.27, 7.0.4, or 7.1-rc1 and later. The upstream stable patches are available at https://git.kernel.org/stable/c/5edd564ccb002ffc830e7818c1c4a992db774678 and the three companion backport commits. Ubuntu users should apply the kernel updates published in USN-8489-1 (https://ubuntu.com/security/notices/USN-8489-1) and USN-8488-1 (https://ubuntu.com/security/notices/USN-8488-1). As a compensating control on systems where immediate kernel upgrade is not feasible, blacklisting the nouveau kernel module via /etc/modprobe.d/blacklist-nouveau.conf and regenerating the initramfs eliminates the vulnerable code path entirely; the trade-off is loss of GPU hardware acceleration and display management through nouveau, which is acceptable on headless servers or systems using the proprietary NVIDIA driver instead.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

Share

EUVD-2026-35433 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy