Cloudanix VulnDB

CVE-2026-98517

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux graphics driver for certain NVIDIA cards can let a local user read or corrupt kernel memory, which may crash the whole machine.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free read in nouveau_uvmm_sm() when a buffer object resides in TTM_PL_SYSTEM; the code casts a generic ttm_resource to struct nouveau_mem and dereferences mem->mem.type, reading past the end of the allocated slab object.

Why it matters to the business

Systems using the open-source nouveau driver for NVIDIA GPUs may experience kernel crashes or memory-safety violations; the issue affects recent Linux kernels and requires prompt patching to maintain stability on GPU workloads.

How an attack unfolds

An attacker with local access crafts GEM buffer objects that remain in system memory rather than VRAM or TT, then triggers nouveau_uvmm_sm bind/unmap operations through the DRM ioctl path; the resulting mis-typed access produces a KASAN-detected slab read that can be turned into information disclosure or used to corrupt kernel state.

How to fix it

Apply the upstream fix that ensures bo->resource is validated as struct nouveau_mem before accessing mem->mem.type; update to a kernel containing the resolution of CVE-2026-98517; disable the nouveau driver or switch to the proprietary NVIDIA driver as a temporary mitigation if patching is delayed.

How to confirm the fix worked

Boot the patched kernel and exercise nouveau GEM creation, mapping, and unmapping workloads while monitoring for KASAN reports; confirm absence of the slab-use-after-free warning in nouveau_uvmm.c:152 and related call sites; verify the fix appears in the git log for drivers/gpu/drm/nouveau/nouveau_uvmm.c.

Typical attack path

  1. Obtain local unprivileged access on a system with nouveau loaded
  2. Allocate a GEM BO via nouveau_gem_ioctl_new that lands in TTM_PL_SYSTEM
  3. Issue bind/unmap operations through DRM ioctls that reach nouveau_uvmm_sm
  4. Trigger the workqueue path (nouveau_sched_run_job) that calls op_map and nouveau_uvma_map
  5. Read or corrupt kernel memory via the out-of-bounds slab access

How to detect it

Search kernel logs for KASAN reports containing nouveau_uvmm_vmm_map, nouveau_uvma_map, op_map, or nouveau_uvmm_sm; inspect dmesg and journalctl for slab-use-after-free messages originating from drivers/gpu/drm/nouveau/; correlate with processes issuing DRM ioctls on nouveau devices.

What your security team should do

  • Prioritize kernel updates on all systems exposing the nouveau driver within the next 7 days
  • Add nouveau_uvmm.c and nouveau_uvma_map to kernel fuzzing and static-analysis pipelines
  • Monitor for KASAN or UBSAN reports referencing nouveau_uvmm_sm in production logs
  • Consider blacklisting nouveau on servers where the proprietary driver is viable

The record

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM nouveau_uvmm_sm() calls op_map(), which passes bo->resource through nouveau_mem() to nouveau_uvma_map(). nouveau_uvmm_vmm_map() then reads mem->mem.type. But this is only valid when bo->resource is backed by struct nouveau_mem, as is the case for VRAM and TT resources. If the BO is left in TTM_PL_SYSTEM, bo->resource is only a struct ttm_resource. Treating it as struct nouveau_mem makes the mem->mem.type read past the end of the resource, causing a KASAN: slab-use-after-free Read in nouveau_uvmm_sm report: BUG: KASAN: slab-use-after-free in nouveau_uvmm_vmm_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:152 [inline] BUG: KASAN: slab-use-after-free in nouveau_uvma_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:199 [inline] BUG: KASAN: slab-use-after-free in op_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:849 [inline] BUG: KASAN: slab-use-after-free in nouveau_uvmm_sm.constprop.0+0x6ab/0x900 drivers/gpu/drm/nouveau/nouveau_uvmm.c:903 Read of size 1 at addr ffff888127d3e3a0 by task kworker/0:1/11 CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 7.2.0 #5 PREEMPT(lazy) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: nouveau_sched_wq_2224 drm_sched_run_job_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x95/0xe0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcb/0x5a0 mm/kasan/report.c:482 kasan_report+0xca/0x100 mm/kasan/report.c:595 nouveau_uvmm_vmm_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:152 [inline] nouveau_uvma_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:199 [inline] op_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:849 [inline] nouveau_uvmm_sm.constprop.0+0x6ab/0x900 drivers/gpu/drm/nouveau/nouveau_uvmm.c:903 nouveau_uvmm_sm_unmap drivers/gpu/drm/nouveau/nouveau_uvmm.c:932 [inline] nouveau_uvmm_bind_job_run+0xd6/0x250 drivers/gpu/drm/nouveau/nouveau_uvmm.c:1532 nouveau_job_run drivers/gpu/drm/nouveau/nouveau_sched.c:350 [inline] nouveau_sched_run_job+0x62/0xd0 drivers/gpu/drm/nouveau/nouveau_sched.c:364 drm_sched_run_job_work+0x356/0xa10 drivers/gpu/drm/scheduler/sched_main.c:1061 process_one_work+0x8a5/0x1900 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5dd/0xd80 kernel/workqueue.c:3486 kthread+0x31d/0x420 kernel/kthread.c:436 ret_from_fork+0x662/0x940 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Allocated by task 2224 on cpu 0 at 66.550027s: kasan_save_stack+0x24/0x50 mm/kasan/common.c:57 kasan_save_track+0x17/0x60 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5334 [inline] __kmalloc_noprof+0x304/0x7c0 mm/slub.c:5359 _kmalloc_noprof include/linux/slab.h:992 [inline] dma_resv_list_alloc+0x27/0x90 drivers/dma-buf/dma-resv.c:106 dma_resv_reserve_fences+0x60e/0xa30 drivers/dma-buf/dma-resv.c:205 ttm_bo_alloc_resource+0x12c/0xbd0 drivers/gpu/drm/ttm/ttm_bo.c:721 ttm_bo_validate+0x1bc/0x4a0 drivers/gpu/drm/ttm/ttm_bo.c:856 ttm_bo_init_reserved+0x2c3/0x570 drivers/gpu/drm/ttm/ttm_bo.c:970 nouveau_bo_init+0x159/0x2c0 drivers/gpu/drm/nouveau/nouveau_bo.c:359 nouveau_gem_new+0x234/0x5f0 drivers/gpu/drm/nouveau/nouveau_gem.c:272 nouveau_gem_ioctl_new+0x1eb/0x420 drivers/gpu/drm/nouveau/nouveau_gem.c:352 drm_ioctl_kernel+0x192/0x350 drivers/gpu/drm/drm_ioctl.c:817 drm_ioctl+0x4f8/0xb40 drivers/gpu/drm/drm_ioctl.c:914 nouveau_drm_ioctl+0xea/0x2c0 drivers/gpu/drm/nouveau/nouveau_drm.c:1338 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x180/0x1d0 fs/ioctl.c:583 do_syscall_x64 ar ---truncated---

Affected packages

Ecosystem Package Introduced Fixed