CVE-2026-98515 drm/nouveau: fix double-free in nvif_vmm_dtor

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix double-free in nvifvmmdtor On failure, nouveaucliinit calls nouveauclifini to tear the client down. Then, nouveaudrmopen also enters into its cleanup path and calls nouveauclifini AGAIN. nouveauclifini calls...

CVE-2026-98515

The Linux kernel contains a double-free vulnerability within the drm/nouveau driver, specifically in the nvif_vmm_dtor function. The issue arises because nouveau_cli_init() calls nouveau_cli_fini() upon failure, while nouveau_drm_open() may also trigger nouveau_cli_fini() during its cleanup path....

EUVD-2026-103755

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix double-free in nvifvmmdtor On failure, nouveaucliinit calls nouveauclifini to tear the client down. Then, nouveaudrmopen also enters into its cleanup path and calls nouveauclifini AGAIN. nouveauclifini calls...

CVE-2026-98515 drm/nouveau: fix double-free in nvif_vmm_dtor

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix double-free in nvifvmmdtor On failure, nouveaucliinit calls nouveauclifini to tear the client down. Then, nouveaudrmopen also enters into its cleanup path and calls nouveauclifini AGAIN. nouveauclifini calls...

CVE-2026-98514

The Linux kernel contains a memory management issue within the drm/nouveau driver. Specifically, a gem reference leak occurs in the validate_init() function during ttm_bo_reserve() failure and "vma not found" error paths. In these scenarios, the loop breaks without adding the looked-up object to ...

EUVD-2026-103754

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validateinit On the ttmboreserve failure and "vma not found" error paths, the loop breaks without adding the looked-up object to any validate list, so the reference taken by drmgemobjectlook...

CVE-2026-98514 drm/nouveau: Fix gem reference leak in validate_init()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validateinit On the ttmboreserve failure and "vma not found" error paths, the loop breaks without adding the looked-up object to any validate list, so the reference taken by drmgemobjectlook...

CVE-2026-98514 drm/nouveau: Fix gem reference leak in validate_init()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validateinit On the ttmboreserve failure and "vma not found" error paths, the loop breaks without adding the looked-up object to any validate list, so the reference taken by drmgemobjectlook...

CVE-2026-98513

The Linux kernel contains a vulnerability in the drm/nouveau driver within the nouveau_connector_detect() function. The root cause is a runtime PM leak occurring when nvif_outp_edid_get() fails, as the function returns early without dropping the runtime PM reference acquired at the start. This ca...

EUVD-2026-103753

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix runtime PM leak in nouveauconnectordetect If nvifoutpedidget fails, nouveauconnectordetect returns early without dropping the runtime PM reference taken at the start of the function, keeping the device powered on...

CVE-2026-98513 drm/nouveau: Fix runtime PM leak in nouveau_connector_detect()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix runtime PM leak in nouveauconnectordetect If nvifoutpedidget fails, nouveauconnectordetect returns early without dropping the runtime PM reference taken at the start of the function, keeping the device powered on...

CVE-2026-98513 drm/nouveau: Fix runtime PM leak in nouveau_connector_detect()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix runtime PM leak in nouveauconnectordetect If nvifoutpedidget fails, nouveauconnectordetect returns early without dropping the runtime PM reference taken at the start of the function, keeping the device powered on...

CVE-2026-98512

The Linux kernel contains a vulnerability in the drm/nouveau component where the nouveau_sched object is improperly freed using kfree() instead of kfree_rcu(). Because nouveau_sched_destroy() calls nouveau_sched_fini() before freeing the object, a finished fence exported to userspace via drm_sync...

EUVD-2026-103752

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: RCU-free the scheduler-containing nouveausched struct nouveausched embeds a struct drmgpuscheduler base. nouveauscheddestroy calls nouveauschedfini which does drmschedfini&sched-base and then frees the object with...

CVE-2026-98512 drm/nouveau: RCU-free the scheduler-containing nouveau_sched

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: RCU-free the scheduler-containing nouveausched struct nouveausched embeds a struct drmgpuscheduler base. nouveauscheddestroy calls nouveauschedfini which does drmschedfini&sched-base and then frees the object with...

CVE-2026-98512 drm/nouveau: RCU-free the scheduler-containing nouveau_sched

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: RCU-free the scheduler-containing nouveausched struct nouveausched embeds a struct drmgpuscheduler base. nouveauscheddestroy calls nouveauschedfini which does drmschedfini&sched-base and then frees the object with...

CVE-2026-98511 drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't bump pin count on failed re-pin in nouveaubopinlocked nouveaubopinlocked checks whether an already pinned BO is in a memory domain compatible with a new pin request. When the domains are incompatible, it sets...

CVE-2026-98511

The Linux kernel 's nouveau driver contains a vulnerability in the nouveau_bo_pin_locked() function. When an already pinned Buffer Object (BO) is requested to be moved to an incompatible memory domain, the function correctly returns -EBUSY but fails to prevent a call to ttm_bo_pin() . Consequentl...

CVE-2026-98511 drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't bump pin count on failed re-pin in nouveaubopinlocked nouveaubopinlocked checks whether an already pinned BO is in a memory domain compatible with a new pin request. When the domains are incompatible, it sets...

EUVD-2026-103751

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't bump pin count on failed re-pin in nouveaubopinlocked nouveaubopinlocked checks whether an already pinned BO is in a memory domain compatible with a new pin request. When the domains are incompatible, it sets...