Linux kernel nouveau: double-free of VMM page array when client init fails on device open
Impact
A local user opening the nouveau DRM device can trigger a double-free of the VMM page array: when nouveau_cli_init() fails it already calls nouveau_cli_fini(), and nouveau_drm_open() then calls it again, freeing vmm->page twice because the pointer is never cleared. A double-free in slab memory is the classic starting point for local privilege escalation on the node, which on a GPU host means the kernel that also mediates every other tenant's device access. Relevant only where nouveau is the loaded driver - fleets running the proprietary NVIDIA driver do not bind nouveau, and many operators blacklist it, so exposure is narrow in practice. Found by fuzzing, no evidence of exploitation in the record.
Who can reach it
Local user with open access to the nouveau DRM char device (/dev/dri/*), which inside a GPU container means any tenant handed a DRI device node. No authentication beyond having the device node; no remote path.
What to do
Pick up the fixed stable kernel for your series (five stable branches carry the fix; see the git.kernel.org commits) and reboot the node. If nouveau is not in use, confirm it is not loaded or blacklist it - that removes the exposure without a reboot schedule. No vendor advisory with fixed version numbers beyond the stable commits is in the record.
References
Related entries
- Linux kernel nouveau/uvmm: use-after-free reading resource type when BO sits in TTM_PL_SYSTEMCVE-2026-98517 · Linux kernel nouveau uvmm (GPU VA bind path, TTM_PL_SYSTEM resource)High
- Linux kernel amdkfd: cached address_space for /dev/kfd causes use-after-free and missed unmap on GPU resetCVE-2026-98520 · Linux kernel amdgpu/amdkfd (kfd_dev_mapping cached address_space)High
- Linux kernel drm/xe: final framebuffer unpin leaves a stale pinned-list entry and risks use-after-freeCVE-2026-98999 · Linux kernel drm/xe (pinned_link bookkeeping on framebuffer unpin)High
- Linux drm/i915: execbuffer relocation cleanup frees past the exec array after command-parser VMAsCVE-2026-99006 · Linux kernel drm/i915 GEM execbuffer (relocation cleanup past the exec array)High
- NVIDIA GPU Display Driver - kernel mode layer (Windows nvlddmkm.sys and Linux nvidia.ko): An out-of-bounds readCVE-2022-28183 · NVIDIA GPU Display Driver - kernel mode layer (Windows nvlddmkm.sys and Linux nvidia.ko)High
- DGX servers BMC: Improper access control on BMCCVE-2022-42275 · DGX servers BMCHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.