EUVD-2026-80403
GHSA-6w43-3678-pp8f
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local unprivileged access to the DRM device (AV:L/PR:L); AC:H because it is a narrow teardown race with no current in-tree trigger; heap UAF yields full C/I/A impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau: unsubscribe the channel-kill event before the fence context
nouveau_channel_del() tears the fence context down first and only drops the channel-kill subscription later, in the middle of the nvif object teardown:
if (chan->fence) nouveau_fence(chan->cli->drm)->context_del(chan); ... nvif_object_dtor(&chan->vram); nvif_event_dtor(&chan->kill);
The subscribed handler is nouveau_channel_killed(), which calls nouveau_channel_kill() and from there nouveau_fence_context_kill() on chan->fence. A kill event delivered in that window takes fctx->lock and walks fctx->pending on a fence context that context_del() has already freed.
Nothing reaches this below Fermi today, because the subscription is gated on FERMI_CHANNEL_GPFIFO and nothing kills a channel there. On Fermi and newer the window is real but narrow, since a kill has to land exactly while the channel is being destroyed. That is reason enough on its own, which is why this carries a Fixes: tag. The last patch in this series subscribes Tesla channels as well; nothing kills those today, so it does not widen the exposure now, but it is the groundwork for a recovery path that would, and the ordering is better fixed before that lands than alongside it.
Drop the subscription before anything it depends on is torn down.
AnalysisAI
Use-after-free in the Linux kernel's in-tree nouveau DRM driver lets a local user who can access the nouveau device node on a Fermi-generation or newer NVIDIA GPU potentially corrupt memory during channel teardown. The bug is an ordering flaw in nouveau_channel_del(): the channel's fence context is freed by context_del() before the channel-kill event subscription is dropped, so a kill event delivered in that narrow window makes nouveau_channel_killed() call nouveau_fence_context_kill() on an already-freed fence context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local access to the nouveau DRM device on a system running the open-source nouveau driver (not the proprietary NVIDIA driver) with a Fermi-generation or newer GPU, since the vulnerable channel-kill subscription is gated on FERMI_CHANNEL_GPFIFO; nothing below Fermi reaches the code. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-priority use-after-free (CWE-416, though the CWE field is N/A in the input) in the Linux kernel's open-source nouveau NVIDIA GPU driver. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux 6.12.110, 6.18.51, 7.2.5 or 7.3-rc2 (or later), which contain the reordering fix that drops the channel-kill subscription before the fence context it depends on is torn down; the individual stable commits are f3830fdd6930e233d727f29eee1617f7e6a0e9e5, 511585987d27d8cb668acebd399fc4deda23404c, 1fef7553dc628295c1208a4f2ac2094c62886e5d and f5a79a9ebfbafb87ca7a896e8d6b5f33a98d097e. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify which Linux hosts load the nouveau kernel module and expose nouveau/DRI device nodes to non-administrative local users, noting that systems using NVIDIA's proprietary driver are not affected, and record CVE-2026-89803 in the vulnerability register with the affected asset list; where patching cannot happen immediately, restrict access to the DRI device nodes to trusted accounts or prevent the nouveau module from loading on hosts where it is not required. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today