nouveau UVMM: failed sparse-unmap bind job frees a live VA region, leading to use-after-free
Impact
In the OP_UNMAP_SPARSE path, op->reg is filled from a lookup that takes no reference, and two failure paths (region busy, and drm_gpuvm_sm_unmap_ops_create() failing) leave it set. The cleanup path then removes and puts a region the job never created, dropping the VA region tree's only reference. A single job can reach this when the ops-create allocation returns -ENOMEM; if another job still owns that region, its own cleanup touches freed memory - a use-after-free in kernel VA-management state. On a node running the open nouveau driver this is reachable by anyone holding a render node fd, so a tenant with a GPU pod can corrupt kernel memory from inside their container. Most datacenter NVIDIA fleets run the proprietary or open NVIDIA kernel modules rather than nouveau, which is what limits the blast radius here.
Who can reach it
Local. Any process that can open /dev/dri/renderD* on a nouveau-driven GPU and submit VM bind jobs, which includes an unprivileged tenant in a container with the render device passed through. No authentication beyond device access.
What to do
Apply the stable-kernel update that clears op->reg on both failure paths. Because the flaw is in the in-tree nouveau kernel module, fixing it means installing the patched kernel and rebooting the node - drain jobs first. Nodes using the NVIDIA proprietary or open GPU kernel modules with nouveau blacklisted are not exposed; blacklisting nouveau is a valid interim mitigation on those nodes.
References
Related entries
- nouveau: channel-kill event stays subscribed after the fence context is freed, racing teardownCVE-2026-89803 · Linux kernel nouveau (nouveau_channel_del teardown ordering, channel-kill event)High
- drm_pagemap: use-after-put in the device-to-RAM migration error path, plus missing THP fallbackCVE-2026-89805 · Linux kernel drm_pagemap (drm_pagemap_migrate_populate_ram_pfn folio fallback)High
- amdkfd: uninitialized return on a hole in the migrated range drops VRAM pages just allocatedCVE-2026-89808 · Linux kernel amdkfd (svm_migrate_copy_to_vram, hole in the migration VM range)High
- amdkfd: device-to-RAM migration error path releases pages by DMA address, corrupting unrelated pagesCVE-2026-89810 · Linux kernel amdkfd (svm_migrate_copy_to_ram error path, DMA address used as PFN)High
- amdgpu: rings outside a partition index the isolation array out of bounds on SDMA submitCVE-2026-89814 · Linux kernel amdgpu (adev->isolation[] indexed with AMDGPU_XCP_NO_PARTITION)High
- drm/ttm: stale restore state after a successful restore leaves shmem handles in the page arrayCVE-2026-89815 · Linux kernel drm/ttm (ttm_pool_restore_and_alloc, stale tt->restore)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.