CVE-2026-89553

What it actually does

Race condition in nouveau gem info ioctl allows vma to be freed by concurrent gem close path, resulting in use-after-free of kernel object.

Why it matters to the business

Local users on Linux systems using the nouveau NVIDIA driver may trigger kernel instability, crashes, or privilege escalation, increasing risk of system compromise or denial of service.

How an attack unfolds

A local attacker opens a nouveau device, creates gem objects, and concurrently invokes the info ioctl while triggering gem close operations to win the race and access freed vma memory for arbitrary read/write or crash.

How to fix it

Apply the upstream kernel commit that adds bo reservation around the vma lookup in the gem info ioctl; rebuild and deploy updated kernel packages containing the fix.

How to confirm the fix worked

Verify the presence of the reserve-bo-in-info-ioctl change in the running kernel source or dmesg after boot; test concurrent gem operations under load to confirm absence of UAF reports.

Typical attack path

1. Open nouveau character device and allocate gem buffer object
2. Spawn concurrent threads or processes performing info ioctl lookups
3. Trigger gem close path to free the vma while lookup is in progress
4. Access the dangling vma pointer to perform use-after-free operations
5. Escalate to kernel code execution or cause denial of service

How to detect it

Inspect kernel logs for nouveau-related use-after-free warnings, slab corruption messages, or oops traces referencing gem or vma structures; correlate with process activity on graphics devices.

What your security team should do

• Prioritize kernel updates on all systems exposing nouveau to untrusted local users
• Restrict unprivileged access to /dev/dri or nouveau devices where possible
• Monitor EPSS and exploit maturity indicators for any future rise in weaponization