Linux kernel nouveau/uvmm: use-after-free reading resource type when BO sits in TTM_PL_SYSTEM
Impact
When a buffer object is left in TTM_PL_SYSTEM, its bo->resource is a plain struct ttm_resource, but the uvmm bind path casts it to struct nouveau_mem and reads mem->mem.type past the end of the allocation. A local user submitting GPU VA bind/unbind jobs gets a slab use-after-free read in a kernel worker, which is an information-disclosure and memory-corruption primitive on the host kernel. Exposure is limited to nodes actually running nouveau with the userspace VMM uAPI; fleets on the proprietary NVIDIA driver are not affected. Found by fuzzing; no exploitation reported in the record.
Who can reach it
Local user able to open the nouveau DRM device and submit VM_BIND jobs - in a container that is any tenant handed a DRI device node. No further authentication required.
What to do
Upgrade to a stable kernel carrying the fix for your series (five stable commits listed) and reboot the node. Where nouveau is unused, keeping the module unloaded or blacklisted removes the exposure without a maintenance window. The record names no distro fixed versions.
References
Related entries
- Linux kernel amdkfd: cached address_space for /dev/kfd causes use-after-free and missed unmap on GPU resetCVE-2026-98520 · Linux kernel amdgpu/amdkfd (kfd_dev_mapping cached address_space)High
- Linux kernel drm/xe: final framebuffer unpin leaves a stale pinned-list entry and risks use-after-freeCVE-2026-98999 · Linux kernel drm/xe (pinned_link bookkeeping on framebuffer unpin)High
- Linux drm/i915: execbuffer relocation cleanup frees past the exec array after command-parser VMAsCVE-2026-99006 · Linux kernel drm/i915 GEM execbuffer (relocation cleanup past the exec array)High
- NVIDIA GPU Display Driver - kernel mode layer (Windows nvlddmkm.sys and Linux nvidia.ko): An out-of-bounds readCVE-2022-28183 · NVIDIA GPU Display Driver - kernel mode layer (Windows nvlddmkm.sys and Linux nvidia.ko)High
- DGX servers BMC: Improper access control on BMCCVE-2022-42275 · DGX servers BMCHigh
- KAI Scheduler: Missing authentication on API endpointsCVE-2026-24177 · KAI SchedulerHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.