nouveau: channel-kill event stays subscribed after the fence context is freed, racing teardown

Impact

nouveau_channel_del() tears down the channel's fence context before it drops the channel-kill event subscription. A kill event delivered in that window runs nouveau_channel_killed() -> nouveau_fence_context_kill(), which takes a lock in and walks a list inside a fence context that has already been freed. The upstream commit describes the window as real but narrow on Fermi and newer - the GPU has to kill a channel at the exact moment the channel is being destroyed - and unreachable below Fermi, where nothing kills channels today. This is a use-after-free in kernel GPU state rather than a directly steerable primitive; the practical risk on a shared node is a host crash that takes every tenant on the box down with it. Only nodes running the in-tree nouveau driver are affected.

Who can reach it

Local. A process holding a nouveau DRM fd that can create and destroy channels while triggering GPU faults; the attacker does not control the timing of the kill event directly, so the race is hard to drive deliberately.

What to do

Take the stable-kernel update that moves nvif_event_dtor(&chan->kill) ahead of the fence-context teardown. Kernel fix, so drain and reboot the node. Nodes that blacklist nouveau in favour of the NVIDIA proprietary or open kernel modules are unaffected.

References

Related entries

• drm_pagemap: use-after-put in the device-to-RAM migration error path, plus missing THP fallbackCVE-2026-89805 · Linux kernel drm_pagemap (drm_pagemap_migrate_populate_ram_pfn folio fallback)High
• amdkfd: uninitialized return on a hole in the migrated range drops VRAM pages just allocatedCVE-2026-89808 · Linux kernel amdkfd (svm_migrate_copy_to_vram, hole in the migration VM range)High
• amdkfd: device-to-RAM migration error path releases pages by DMA address, corrupting unrelated pagesCVE-2026-89810 · Linux kernel amdkfd (svm_migrate_copy_to_ram error path, DMA address used as PFN)High
• amdgpu: rings outside a partition index the isolation array out of bounds on SDMA submitCVE-2026-89814 · Linux kernel amdgpu (adev->isolation[] indexed with AMDGPU_XCP_NO_PARTITION)High
• drm/ttm: stale restore state after a successful restore leaves shmem handles in the page arrayCVE-2026-89815 · Linux kernel drm/ttm (ttm_pool_restore_and_alloc, stale tt->restore)High
• Linux kernel drm/xe: flat CCS storage published as usable VRAM, corrupting allocationsCVE-2026-90047 · Linux kernel drm/xe (flat CCS offset rounding)High