Linux kernel (drivers/gpu/drm/nouveau): A buffer object imported over PRIME leaves a dangling pointer behind, and the

Impact

A buffer object imported over PRIME leaves a dangling pointer behind, and the deferred TTM delete worker later walks it - the oops trace shows classic freed-slab poison being dereferenced. A tenant driving dma-buf import and release controls when the freed object is touched, turning it into a use-after-free in kernel worker context.

Who can reach it

A tenant process holding /dev/dri/renderD* on a nouveau GPU imports and releases dma-bufs in a loop; the fault lands asynchronously in the TTM delayed-delete workqueue, so it is not confined to the tenant's own task. Conditional on the node using the upstream nouveau driver.

What to do

Boot a kernel carrying the nouveau prime lifetime fix below. Interim: on nouveau nodes, withhold /dev/dri/renderD* from untrusted tenants, or forbid dma-buf import for workloads that do not need buffer sharing across devices.

References