CVE-2026-98514

What it actually does

Unreleased drm_gem_object reference on ttm_bo_reserve and vma-not-found error paths in nouveau's validate_init, bypassing validate_fini cleanup and causing a memory leak.

Why it matters to the business

Repeated triggering can exhaust kernel memory on systems using the Nouveau driver, leading to instability or denial of service for graphics workloads.

How an attack unfolds

An attacker with local access crafts GPU object operations that hit the reserve or lookup failure paths repeatedly, leaking references without any external threat actor involvement or ransomware use.

How to fix it

Update to a Linux kernel containing the referenced fix for the gem reference leak in validate_init; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting drm/nouveau/nouveau_gem.c for the added drm_gem_object_put calls on both error paths; test by forcing the error conditions and verifying no reference count growth.

Typical attack path

1. Obtain local execution on a system using the Nouveau DRM driver
2. Trigger drm_gem_object_lookup followed by ttm_bo_reserve failure or missing VMA
3. Repeat the operation to accumulate unreleased references
4. Monitor for kernel memory pressure or OOM conditions

How to detect it

Review kernel logs for nouveau-related allocation warnings or OOM killer activity on GPU-using hosts; no specific post-exploitation artifacts are observable without custom instrumentation.

What your security team should do

• Prioritize kernel updates on any systems exposing Nouveau to untrusted local users
• Monitor EPSS and KEV status for changes given the five-day publication window
• Restrict unprivileged access to GPU device nodes until patched