NVIDIA open GPU kernel module: missing self-reference guard in map cleanup gives a use-after-free
Impact
The Resource Server's map cleanup path does not guard against an object referencing itself, so cleanup frees memory that is still in use. An unprivileged local user can set up the self-referencing mapping deliberately, which makes this more deterministic than a timing-dependent race. This is in the open-source kernel module that NVIDIA now ships by default on recent datacenter boards, so most current fleets are running the affected code.
Who can reach it
Local, unprivileged. Any tenant with a GPU pod or a local user with the NVIDIA device nodes.
What to do
Update to the driver branch from NVIDIA bulletin 2026/5861; the record states no fixed version. Rebuild or reinstall the open kernel modules, then drain and reboot each GPU node; verify DKMS rebuilt the module before returning the node to the pool.
References
Related entries
- NVIDIA open GPU kernel module: memory access permissions are lost during DMA mappingCVE-2026-47599 · NVIDIA open GPU kernel module for Linux (DMA mapping path)High
- NVIDIA GPU driver: error-handling path operates on an improperly initialized resourceCVE-2026-47600 · NVIDIA GPU Display Driver for Windows and Linux (kernel mode layer, error handling)High
- NVIDIA open GPU kernel module: read-only DMA-BUF imported from another device becomes writableCVE-2026-47601 · NVIDIA open GPU kernel module (DMA-BUF import path)High
- Linux kernel Intel Xe dma-buf import: retry loop reuses a buffer object that was already freedCVE-2026-52950 · Linux kernel drm/xe dma-buf (use-after-free in the import retry loop)High
- Linux kernel Intel Xe dma-buf: attaching before init exposes an empty or freed buffer object to the exporterCVE-2026-52951 · Linux kernel drm/xe dma-buf (attach before buffer-object init, invalidate_mappings races)High
- Linux kernel Intel Xe: exec queue creation error paths free a queue still linked into VM and engine-group listsCVE-2026-52976 · Linux kernel drm/xe (xe_exec_queue_create_ioctl error paths)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.