CVE-2026-98875

What it actually does

NULL pointer dereference in the Nouveau DRM driver during GSP-RM initialization on GA100 chips because the chip table lacks a .sec2 entry, leaving device->sec2 unset when the booter constructor runs.

Why it matters to the business

Systems with affected NVIDIA GPUs using the open-source Nouveau driver experience kernel crashes or boot failures, causing unplanned downtime and potential data loss on restart.

How an attack unfolds

An attacker triggers Nouveau driver initialization on vulnerable hardware; the missing SEC2 entry results in a NULL dereference during tu102_gsp_oneinit, crashing the kernel.

How to fix it

Apply the upstream kernel commit that adds the SEC2 entry to the GA100 chip table; rebuild and deploy the patched kernel image.

How to confirm the fix worked

Confirm the .sec2 field exists in the GA100 chip table definition and that tu102_gsp_oneinit completes without NULL dereference on boot.

Typical attack path

1. Load or reload the Nouveau kernel module on GA100 hardware
2. Trigger GSP-RM boot path that calls the booter constructor
3. Dereference the unset device->sec2 pointer leading to kernel panic

How to detect it

Search kernel logs and crash dumps for messages referencing tu102_gsp_oneinit, SEC2 falcon, or NULL dereference during nouveau GSP boot.

• tu102_gsp_oneinit
• device->sec2 is NULL
• nouveau gsp booter

What your security team should do

• Prioritize patching systems that rely on the Nouveau driver for GA100 GPUs
• Test patched kernels in a staging environment before broad deployment
• Monitor kernel logs for nouveau-related oops messages during driver initialization