nouveau GemInfo UAF

Vulnerability analysis

In the nouveau DRM driver, the GEM info ioctl looks up a virtual memory area for a buffer object without first locking the buffer. A concurrent thread executing the GEM close path can free that VMA in the window between the lookup and the subsequent read of its address, resulting in a use-after-free. The fix reserves the buffer object before performing the VMA lookup and releases it afterward, ensuring the close path cannot tear down the VMA while the info query is in progress. This is reachable locally by any user with access to the nouveau DRM device node — typically members of the video or render group — and requires an NVIDIA GPU with the nouveau driver loaded.