CVE-2026-98516

What it actually does

Reference leak: pci_get_domain_bus_and_slot acquires a PCI device reference that is never dropped after nv1a_ram_new reads memory size from config space.

Why it matters to the business

Long-running Linux systems using the nouveau driver may gradually exhaust kernel memory references; the issue has very low public exploitability and no known campaigns.

How an attack unfolds

An attacker would need to trigger repeated initialization paths in nv1a_ram_new on affected hardware; the leak itself provides no direct code execution or privilege escalation and remains unexploited in the wild.

How to fix it

Update the Linux kernel to a version containing the referenced fix in drm/nouveau; rebuild and reboot if using a custom kernel build.

How to confirm the fix worked

Confirm the patch is present by inspecting the nv1a_ram_new function for a pci_dev_put call after the config-space read; verify with kernel version checks or source diff.

Typical attack path

1. Identify system running vulnerable nouveau driver on supported NVIDIA hardware
2. Trigger repeated GPU probe or RAM initialization paths
3. Observe gradual accumulation of unreleased PCI references leading to resource pressure

How to detect it

Examine kernel logs for nouveau initialization messages and monitor for abnormal growth in PCI device reference counts; no public exploitation artifacts exist.

What your security team should do

• Prioritize kernel updates on systems with nouveau in use within the next maintenance window
• Monitor upstream stable kernel releases for backports of this fix
• Review nouveau usage; migrate to vendor drivers where feasible to reduce attack surface