CVE-2026-98518 drm/nouveau/dmem: pin VRAM for the whole registered range

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: pin VRAM for the whole registered range Commit c32287471077 "gpu/drm/nouveau: enable THP support for GPU memory migration" grew the device-private region that nouveaudmemchunkalloc registers from DMEMCHUNKSIZE t...

CVE-2026-98518 drm/nouveau/dmem: pin VRAM for the whole registered range

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: pin VRAM for the whole registered range Commit c32287471077 "gpu/drm/nouveau: enable THP support for GPU memory migration" grew the device-private region that nouveaudmemchunkalloc registers from DMEMCHUNKSIZE t...

EUVD-2026-103758

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: pin VRAM for the whole registered range Commit c32287471077 "gpu/drm/nouveau: enable THP support for GPU memory migration" grew the device-private region that nouveaudmemchunkalloc registers from DMEMCHUNKSIZE t...

CVE-2026-98518

The Linux kernel contains a vulnerability in the drm/nouveau/dmem component related to how it handles VRAM registration. Specifically, commit c32287471077 increased the device-private region registered by nouveau_dmem_chunk_alloc() from DMEM_CHUNK_SIZE to DMEM_CHUNK_SIZE * NR_CHUNKS , but failed ...

CVE-2026-98517 drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix UAF in nouveauuvmmsm when BO is in TTMPLSYSTEM nouveauuvmmsm calls opmap, which passes bo-resource through nouveaumem to nouveauuvmamap. nouveauuvmmvmmmap then reads mem-mem.type. But this is only valid when...

CVE-2026-98517 drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix UAF in nouveauuvmmsm when BO is in TTMPLSYSTEM nouveauuvmmsm calls opmap, which passes bo-resource through nouveaumem to nouveauuvmamap. nouveauuvmmvmmmap then reads mem-mem.type. But this is only valid when...

CVE-2026-98517

A use-after-free (UAF) vulnerability exists in the Linux kernel 's nouveau driver, specifically within the uvmm component. The issue occurs in nouveau_uvmm_sm() when it calls op_map(), which passes bo->resource to nouveau_uvma_map(). If the Buffer Object (BO) is left in the TTM_PL_SYSTEM state...

EUVD-2026-103757

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix UAF in nouveauuvmmsm when BO is in TTMPLSYSTEM nouveauuvmmsm calls opmap, which passes bo-resource through nouveaumem to nouveauuvmamap. nouveauuvmmvmmmap then reads mem-mem.type. But this is only valid when...

CVE-2026-98516 drm/nouveau: Fix bridge reference leak in nv1a_ram_new()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix bridge reference leak in nv1aramnew pcigetdomainbusandslot takes a reference to the PCI device, which is never released once the memory size has been read from its config space. Drop the reference before returnin...

CVE-2026-98516 drm/nouveau: Fix bridge reference leak in nv1a_ram_new()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix bridge reference leak in nv1aramnew pcigetdomainbusandslot takes a reference to the PCI device, which is never released once the memory size has been read from its config space. Drop the reference before returnin...

EUVD-2026-103756

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix bridge reference leak in nv1aramnew pcigetdomainbusandslot takes a reference to the PCI device, which is never released once the memory size has been read from its config space. Drop the reference before returnin...

CVE-2026-98516

The Linux kernel contains a vulnerability in the drm/nouveau component where a bridge reference leak occurs in the nv1a_ram_new() function. The issue stems from the pci_get_domain_bus_and_slot() function taking a reference to the PCI device that is not released after the memory size is read from ...

CVE-2026-98515 drm/nouveau: fix double-free in nvif_vmm_dtor

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix double-free in nvifvmmdtor On failure, nouveaucliinit calls nouveauclifini to tear the client down. Then, nouveaudrmopen also enters into its cleanup path and calls nouveauclifini AGAIN. nouveauclifini calls...

EUVD-2026-103755

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix double-free in nvifvmmdtor On failure, nouveaucliinit calls nouveauclifini to tear the client down. Then, nouveaudrmopen also enters into its cleanup path and calls nouveauclifini AGAIN. nouveauclifini calls...

CVE-2026-98515 drm/nouveau: fix double-free in nvif_vmm_dtor

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix double-free in nvifvmmdtor On failure, nouveaucliinit calls nouveauclifini to tear the client down. Then, nouveaudrmopen also enters into its cleanup path and calls nouveauclifini AGAIN. nouveauclifini calls...

CVE-2026-98515

The Linux kernel contains a double-free vulnerability within the drm/nouveau driver, specifically in the nvif_vmm_dtor function. The issue arises because nouveau_cli_init() calls nouveau_cli_fini() upon failure, while nouveau_drm_open() may also trigger nouveau_cli_fini() during its cleanup path....

CVE-2026-98514 drm/nouveau: Fix gem reference leak in validate_init()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validateinit On the ttmboreserve failure and "vma not found" error paths, the loop breaks without adding the looked-up object to any validate list, so the reference taken by drmgemobjectlook...

EUVD-2026-103754

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validateinit On the ttmboreserve failure and "vma not found" error paths, the loop breaks without adding the looked-up object to any validate list, so the reference taken by drmgemobjectlook...

CVE-2026-98514 drm/nouveau: Fix gem reference leak in validate_init()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validateinit On the ttmboreserve failure and "vma not found" error paths, the loop breaks without adding the looked-up object to any validate list, so the reference taken by drmgemobjectlook...

CVE-2026-98514

The Linux kernel contains a memory management issue within the drm/nouveau driver. Specifically, a gem reference leak occurs in the validate_init() function during ttm_bo_reserve() failure and "vma not found" error paths. In these scenarios, the loop breaks without adding the looked-up object to ...