40 matches found
CVE-2026-98517 drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix UAF in nouveauuvmmsm when BO is in TTMPLSYSTEM nouveauuvmmsm calls opmap, which passes bo-resource through nouveaumem to nouveauuvmamap. nouveauuvmmvmmmap then reads mem-mem.type. But this is only valid when...
CVE-2026-98517
A use-after-free (UAF) vulnerability exists in the Linux kernel 's nouveau driver, specifically within the uvmm component. The issue occurs in nouveau_uvmm_sm() when it calls op_map(), which passes bo->resource to nouveau_uvma_map(). If the Buffer Object (BO) is left in the TTM_PL_SYSTEM state...
SUSE CVE-2026-89800
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: clear the dirty flag when unwinding an OPUNMAPSPARSE A successful OPUNMAPSPARSE marks its region dirty with nouveauuvmaregiondirty and defers the teardown to nouveauuvmmbindjobcleanup; it does not remove the...
SUSE CVE-2026-89801
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix premature region free on failed OPUNMAPSPARSE In nouveauuvmmbindjobsubmit's OPUNMAPSPARSE arm, op-reg is set from nouveauuvmaregionfind, which only looks the region up and takes no reference; a region's sole...
SUSE CVE-2026-89802
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix NULL deref unwinding an OPMAPSPARSE op Each bindjobop is zeroed by kzallocobj in bindjobopfromuop, and the OPMAPSPARSE case in nouveauuvmmbindjobsubmit only creates a region, so op-ops stays NULL for a...
AZL-101243 CVE-2026-89802 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix NULL deref unwinding an OPMAPSPARSE op Each bindjobop is zeroed by kzallocobj in bindjobopfromuop, and the OPMAPSPARSE case in nouveauuvmmbindjobsubmit only creates a region, so op-ops stays NULL for a...
DEBIAN-CVE-2026-89800
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: clear the dirty flag when unwinding an OPUNMAPSPARSE A successful OPUNMAPSPARSE marks its region dirty with nouveauuvmaregiondirty and defers the teardown to nouveauuvmmbindjobcleanup; it does not remove the...
DEBIAN-CVE-2026-89801
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix premature region free on failed OPUNMAPSPARSE In nouveauuvmmbindjobsubmit's OPUNMAPSPARSE arm, op-reg is set from nouveauuvmaregionfind, which only looks the region up and takes no reference; a region's sole...
AZL-101622 CVE-2026-89800 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: clear the dirty flag when unwinding an OPUNMAPSPARSE A successful OPUNMAPSPARSE marks its region dirty with nouveauuvmaregiondirty and defers the teardown to nouveauuvmmbindjobcleanup; it does not remove the...
AZL-101661 CVE-2026-89801 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix premature region free on failed OPUNMAPSPARSE In nouveauuvmmbindjobsubmit's OPUNMAPSPARSE arm, op-reg is set from nouveauuvmaregionfind, which only looks the region up and takes no reference; a region's sole...
CVE-2026-89802 drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix NULL deref unwinding an OPMAPSPARSE op Each bindjobop is zeroed by kzallocobj in bindjobopfromuop, and the OPMAPSPARSE case in nouveauuvmmbindjobsubmit only creates a region, so op-ops stays NULL for a...
EUVD-2026-80402
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix NULL deref unwinding an OPMAPSPARSE op Each bindjobop is zeroed by kzallocobj in bindjobopfromuop, and the OPMAPSPARSE case in nouveauuvmmbindjobsubmit only creates a region, so op-ops stays NULL for a...
CVE-2026-89802
CVE-2026-89802 is a NULL pointer dereference in the drm/nouveau/uvmm driver of the Linux kernel . When a NOUVEAU_VM_BIND job contains an OP_MAP_SPARSE operation that is processed successfully, op->ops remains NULL because the sparse-map path only creates a region without allocating ops. If a s...
EUVD-2026-80401
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix premature region free on failed OPUNMAPSPARSE In nouveauuvmmbindjobsubmit's OPUNMAPSPARSE arm, op-reg is set from nouveauuvmaregionfind, which only looks the region up and takes no reference; a region's sole...
CVE-2026-89801
CVE-2026-89801 is a vulnerability in the Linux kernel 's drm/nouveau/uvmm subsystem. The root cause is in nouveau_uvmm_bind_job_submit()'s OP_UNMAP_SPARSE handling: two failure paths (a -ENOENT busy-region check and a drm_gpuvm_sm_unmap_ops_create() failure) leave op->reg set, violating the do...
CVE-2026-89800 drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: clear the dirty flag when unwinding an OPUNMAPSPARSE A successful OPUNMAPSPARSE marks its region dirty with nouveauuvmaregiondirty and defers the teardown to nouveauuvmmbindjobcleanup; it does not remove the...
CVE-2026-89800
CVE-2026-89800 affects the drm/nouveau/uvmm component of the Linux kernel (NVIDIA Nouveau virtual unified memory management). The root cause is a missing cleanup during job unwinding: when a successful OP_UNMAP_SPARSE marks a region dirty and defers teardown, a subsequent failure in a later opera...
CVE-2026-89800 drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: clear the dirty flag when unwinding an OPUNMAPSPARSE A successful OPUNMAPSPARSE marks its region dirty with nouveauuvmaregiondirty and defers the teardown to nouveauuvmmbindjobcleanup; it does not remove the...
PT-2026-93441
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/nouveau/uvmm component where the dirty flag is not cleared when unwinding an OP UNMAP SPARSE operation. When a subsequent operation in a job fails, the unwind...
CVE-2026-89802: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix NULL deref unwinding an OPMAPSPARSE op Each bindjobop is zeroed by kzallocobj in bindjobopfromuop, and the OPMAPSPARSE case in nouveauuvmmbindjobsubmit only creates a region, so op-ops stays NULL for a...