HIGH Introduced in 3.1
nouveau GemInfo UAF
CVE-2026-89553
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: nouveau/gem: reserve the bo in the info ioctl around the vma lookup In the non-uvmm path, there could be a race between the info lookup finding the vma, and the gem close path closing the vma leading to a use-after-free. Spotted with the help of Opus 4.6.
02KernelScan AI Analysis
Risk summary
A race condition in the nouveau DRM driver allows a local user with GPU device access to trigger a use-after-free by concurrently querying and closing a graphics buffer object. This can lead to kernel memory corruption, potentially enabling privilege escalation or a system crash. Systems with NVIDIA GPUs using the nouveau driver and accessible DRM device nodes are affected.
Vulnerability analysis
In the nouveau DRM driver, the GEM info ioctl looks up a virtual memory area for a buffer object without first locking the buffer. A concurrent thread executing the GEM close path can free that VMA in the window between the lookup and the subsequent read of its address, resulting in a use-after-free. The fix reserves the buffer object before performing the VMA lookup and releases it afterward, ensuring the close path cannot tear down the VMA while the info query is in progress. This is reachable locally by any user with access to the nouveau DRM device node — typically members of the video or render group — and requires an NVIDIA GPU with the nouveau driver loaded.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 3.1 | 6.18.50 | ff110e85837d |
| mainline | 3.1 | 7.3-rc1 | 5e17160d41d9 |
| 7.2 | 3.1 | 7.2.4 | e60466011ac3 |
| 6.12 | 3.1 | 6.12.109 | 208867763843 |
| 6.6 | 3.1 | 6.6.157 | e05c28bd6043 |
| cip/6.12 | 3.1 | 6.12.111-cip32 | 208867763843 |