Linux kernel drm_gpusvm: unbalanced notifier-lock release in drm_gpusvm_scan_mm()

CVSS 8.8CVE-2026-63863NVIDIA / GPU stackcurated

Impact

An error path in drm_gpusvm_scan_mm() jumps to err_free before the notifier lock is taken, so the unlock under that label releases a lock that was never held - lockdep reports a bad unlock balance from a kernel worker. drm_gpusvm is the shared-virtual-memory helper that GPU drivers use to mirror a process address space onto the device, so it is on the path for compute workloads that rely on SVM/unified memory rather than on display. The practical exposure is corrupted lock state leading to a kernel oops or hang in a GPU workqueue, which costs the node and every job on it; the record is a lock-balance fix and does not demonstrate memory disclosure or privilege gain, so treat the high CVSS score as the kernel CNA's conservative default rather than as a proven escalation.

Who can reach it

Local: a process using GPU shared virtual memory through a driver built on drm_gpusvm, able to hit the error path in the scan. Normal GPU access is enough - no privileged device or host credentials.

What to do

Update to a stable kernel with the linked fix and reboot the node. There is no runtime mitigation other than avoiding SVM-dependent workloads on the affected kernel. Drain the node before rebooting.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-63863 https://git.kernel.org/stable/c/8efaa47a871662a8c21b819cec60786f7ef17ab4 https://git.kernel.org/stable/c/d287dee565c3c32e1ed76ec1847af46809c29b90

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.