Linux kernel nouveau: use-after-free racing the GEM info ioctl against GEM close
Impact
In the non-uvmm path, the GEM info ioctl looked up a VMA without reserving the buffer object, so a concurrent GEM close can free that VMA while the lookup is still using it. Any process holding the DRM render node can drive both sides of the race, which on a shared node means a local user crashing the machine or, with allocator grooming, corrupting freed kernel memory. The practical exposure in a GPU datacenter is limited: nouveau is the open reverse-engineered NVIDIA driver, and production accelerator fleets run the NVIDIA proprietary or open GPU kernel modules instead. It matters for hosts that fell back to nouveau, and for management or head nodes where nouveau binds the onboard display GPU.
Who can reach it
Local, requiring an open file descriptor on a nouveau DRM device (typically /dev/dri/renderD*, which is often group-accessible or exposed into containers). No privilege beyond that is stated in the record.
What to do
Update to a stable kernel containing the fix, which reserves the buffer object around the VMA lookup, and reboot the node. If nouveau is not needed - the usual case on NVIDIA datacenter GPUs - blacklisting the module removes the exposure without a kernel upgrade, though the node still needs a reboot or a module unload for that to take effect. No fixed version is given in the record beyond the four stable commits.
References
Related entries
- Linux amdgpu: resume force-completes an uninitialized UVD ring on SR-IOV virtual functionsCVE-2026-89827 · Linux kernel amdgpu (UVD ring fence restore under SR-IOV)Unscored
- Linux amdgpu powerplay: malformed VBIOS VoltageObjectInfo table causes infinite loop or heap OOB readCVE-2026-93179 · Linux kernel drm/amd/powerplay (VoltageObjectInfo VBIOS table parser)Unscored
- Linux kernel amdgpu: use of freed module text when RCU callbacks run after module unloadCVE-2026-93809 · Linux kernel amdgpu (missing rcu_barrier() on module unload)Unscored
- Linux kernel amdkfd: user-controlled metadata size lets any render-group user force a huge kernel allocationCVE-2026-93823 · Linux kernel amdkfd (AMDKFD_IOC_GET_DMABUF_INFO metadata buffer)Unscored
- Linux kernel amdgpu: unclamped write position in the vBIOS update sysfs attribute overflows the bufferCVE-2026-97425 · Linux kernel amdgpu (vBIOS update sysfs bin attribute)Unscored
- Linux kernel amdgpu powerplay: pp_table sysfs write memcpys up to PAGE_SIZE into a smaller heap bufferCVE-2026-97427 · Linux kernel amdgpu powerplay (pp_dpm_set_pp_table sysfs store)Unscored
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.