CVE-2026-98517

A use-after-free (UAF) vulnerability exists in the Linux kernel 's nouveau driver, specifically within the uvmm component. The issue occurs in nouveau_uvmm_sm() when it calls op_map(), which passes bo->resource to nouveau_uvma_map(). If the Buffer Object (BO) is left in the TTM_PL_SYSTEM state...

CVE-2026-98517 drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix UAF in nouveauuvmmsm when BO is in TTMPLSYSTEM nouveauuvmmsm calls opmap, which passes bo-resource through nouveaumem to nouveauuvmamap. nouveauuvmmvmmmap then reads mem-mem.type. But this is only valid when...

EUVD-2026-103756

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix bridge reference leak in nv1aramnew pcigetdomainbusandslot takes a reference to the PCI device, which is never released once the memory size has been read from its config space. Drop the reference before returnin...

CVE-2026-98516 drm/nouveau: Fix bridge reference leak in nv1a_ram_new()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix bridge reference leak in nv1aramnew pcigetdomainbusandslot takes a reference to the PCI device, which is never released once the memory size has been read from its config space. Drop the reference before returnin...

CVE-2026-98516 drm/nouveau: Fix bridge reference leak in nv1a_ram_new()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix bridge reference leak in nv1aramnew pcigetdomainbusandslot takes a reference to the PCI device, which is never released once the memory size has been read from its config space. Drop the reference before returnin...

CVE-2026-98516

The Linux kernel contains a vulnerability in the drm/nouveau component where a bridge reference leak occurs in the nv1a_ram_new() function. The issue stems from the pci_get_domain_bus_and_slot() function taking a reference to the PCI device that is not released after the memory size is read from ...

CVE-2026-98515 drm/nouveau: fix double-free in nvif_vmm_dtor

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix double-free in nvifvmmdtor On failure, nouveaucliinit calls nouveauclifini to tear the client down. Then, nouveaudrmopen also enters into its cleanup path and calls nouveauclifini AGAIN. nouveauclifini calls...

EUVD-2026-103755

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix double-free in nvifvmmdtor On failure, nouveaucliinit calls nouveauclifini to tear the client down. Then, nouveaudrmopen also enters into its cleanup path and calls nouveauclifini AGAIN. nouveauclifini calls...

CVE-2026-98515

The Linux kernel contains a double-free vulnerability within the drm/nouveau driver, specifically in the nvif_vmm_dtor function. The issue arises because nouveau_cli_init() calls nouveau_cli_fini() upon failure, while nouveau_drm_open() may also trigger nouveau_cli_fini() during its cleanup path....

CVE-2026-98515 drm/nouveau: fix double-free in nvif_vmm_dtor

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix double-free in nvifvmmdtor On failure, nouveaucliinit calls nouveauclifini to tear the client down. Then, nouveaudrmopen also enters into its cleanup path and calls nouveauclifini AGAIN. nouveauclifini calls...

EUVD-2026-103754

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validateinit On the ttmboreserve failure and "vma not found" error paths, the loop breaks without adding the looked-up object to any validate list, so the reference taken by drmgemobjectlook...

CVE-2026-98514 drm/nouveau: Fix gem reference leak in validate_init()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validateinit On the ttmboreserve failure and "vma not found" error paths, the loop breaks without adding the looked-up object to any validate list, so the reference taken by drmgemobjectlook...

CVE-2026-98514 drm/nouveau: Fix gem reference leak in validate_init()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validateinit On the ttmboreserve failure and "vma not found" error paths, the loop breaks without adding the looked-up object to any validate list, so the reference taken by drmgemobjectlook...

CVE-2026-98514

The Linux kernel contains a memory management issue within the drm/nouveau driver. Specifically, a gem reference leak occurs in the validate_init() function during ttm_bo_reserve() failure and "vma not found" error paths. In these scenarios, the loop breaks without adding the looked-up object to ...

CVE-2026-98513 drm/nouveau: Fix runtime PM leak in nouveau_connector_detect()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix runtime PM leak in nouveauconnectordetect If nvifoutpedidget fails, nouveauconnectordetect returns early without dropping the runtime PM reference taken at the start of the function, keeping the device powered on...

EUVD-2026-103753

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix runtime PM leak in nouveauconnectordetect If nvifoutpedidget fails, nouveauconnectordetect returns early without dropping the runtime PM reference taken at the start of the function, keeping the device powered on...

CVE-2026-98513 drm/nouveau: Fix runtime PM leak in nouveau_connector_detect()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix runtime PM leak in nouveauconnectordetect If nvifoutpedidget fails, nouveauconnectordetect returns early without dropping the runtime PM reference taken at the start of the function, keeping the device powered on...

CVE-2026-98513

The Linux kernel contains a vulnerability in the drm/nouveau driver within the nouveau_connector_detect() function. The root cause is a runtime PM leak occurring when nvif_outp_edid_get() fails, as the function returns early without dropping the runtime PM reference acquired at the start. This ca...

CVE-2026-98512 drm/nouveau: RCU-free the scheduler-containing nouveau_sched

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: RCU-free the scheduler-containing nouveausched struct nouveausched embeds a struct drmgpuscheduler base. nouveauscheddestroy calls nouveauschedfini which does drmschedfini&sched-base and then frees the object with...

EUVD-2026-103752

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: RCU-free the scheduler-containing nouveausched struct nouveausched embeds a struct drmgpuscheduler base. nouveauscheddestroy calls nouveauschedfini which does drmschedfini&sched-base and then frees the object with...