EUVD-2026-80401
GHSA-8x7w-6563-2c2q
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local DRM-node access (AV:L/PR:L); AC:H because the cross-job use-after-free needs a memory-pressure-induced failure plus a concurrent job owning the same region; full-triad kernel memory corruption gives C/I/A:H.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE
In nouveau_uvmm_bind_job_submit()'s OP_UNMAP_SPARSE arm, op->reg is set from nouveau_uvma_region_find(), which only looks the region up and takes no reference; a region's sole reference is its membership in uvmm->region_mt. Two failure paths leave op->reg set: the -ENOENT check when the region is busy, and the drm_gpuvm_sm_unmap_ops_create() failure. The sibling nouveau_uvmm_sm_unmap_prepare() failure just below clears op->reg; these two do not.
unwind_continue steps back one op, so the failing op is skipped by the unwind loop and its op->reg stays set. nouveau_uvmm_bind_job_cleanup() then enters its if (op->reg) branch and calls nouveau_uvma_region_remove() and nouveau_uvma_region_put() on it, dropping the tree's sole reference and freeing a region this job never created. The comment above the cleanup loop documents the broken invariant: op->reg must be NULL on submit failure.
This frees a live region on an unrelated failure, reachable single-job when drm_gpuvm_sm_unmap_ops_create() returns -ENOMEM; if another job owns the same region, its cleanup then removes and puts the freed region, a use-after-free. Clear op->reg on both failure paths.
AnalysisAI
Linux kernel builds containing the open-source Nouveau GPU driver (drm/nouveau/uvmm) fail to clear op->reg on two error paths in nouveau_uvmm_bind_job_submit()'s OP_UNMAP_SPARSE arm, so a job that never created a sparse region can drop the region's only reference in nouveau_uvmm_bind_job_cleanup() and free a live object; a second job still owning that region then performs a use-after-free. Exploitation requires local access to the DRM/render device node and the ability to submit VM_BIND jobs (PR:L), plus a trigger of the -ENOENT busy-region check or an -ENOMEM failure from drm_gpuvm_sm_unmap_ops_create(), with the full use-after-free needing a concurrent job holding the same region. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the Nouveau open-source NVIDIA GPU driver (drm/nouveau) to be loaded and the attacker to have local access to its DRM/render device node to submit VM_BIND jobs (PR:L per vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine memory-safety flaw (use-after-free, effectively CWE-416) in the Linux kernel's open-source Nouveau GPU driver (drm/nouveau/uvmm). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update to a kernel containing the fix: 6.6.157, 6.12.110, 6.18.51, 7.2.5, or 7.3-rc2, or apply the mainline/stable commits referenced in the CVE record (git.kernel.org stable commits 24c25b182d17d1bdfde0088c96bdf6f93e8f46bc, 88114e3a96582882e63b2f73aa7a5a9cf0d5073c, ccf930812f23b8259ef64fd3394d53b093e4651a, ba42d8a1c2c7629c61914df11a7d63ac77449ffb, and 4083d24c2636fde7b18076115af52820d203bc57, distro advisories tracked via EUVD-2026-80401 and https://nvd.nist.gov/vuln/detail/CVE-2026-89801); vendor patch availability is confirmed, so no long-term compensating control should substitute for upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Linux hosts and images that load the Nouveau driver (drm/nouveau/uvmm) rather than NVIDIA's proprietary stack, confirming kernel versions against your distribution's advisory since the vendor patch is published but no specific fix version is stated in this context; prioritize GPU workstations, VDI pools, and multi-tenant container hosts where untrusted local users can open the render node. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today