{"id":"CVE-2026-89801","state":"PUBLISHED","title":"drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE\n\nIn nouveau_uvmm_bind_job_submit()'s OP_UNMAP_SPARSE arm, op->reg is set\nfrom nouveau_uvma_region_find(), which only looks the region up and takes\nno reference; a region's sole reference is its membership in\nuvmm->region_mt. Two failure paths leave op->reg set: the -ENOENT check\nwhen the region is busy, and the drm_gpuvm_sm_unmap_ops_create() failure.\nThe sibling nouveau_uvmm_sm_unmap_prepare() failure just below clears\nop->reg; these two do not.\n\nunwind_continue steps back one op, so the failing op is skipped by the\nunwind loop and its op->reg stays set. nouveau_uvmm_bind_job_cleanup()\nthen enters its if (op->reg) branch and calls nouveau_uvma_region_remove()\nand nouveau_uvma_region_put() on it, dropping the tree's sole reference\nand freeing a region this job never created. The comment above the\ncleanup loop documents the broken invariant: op->reg must be NULL on\nsubmit failure.\n\nThis frees a live region on an unrelated failure, reachable single-job\nwhen drm_gpuvm_sm_unmap_ops_create() returns -ENOMEM; if another job owns\nthe same region, its cleanup then removes and puts the freed region, a\nuse-after-free. Clear op->reg on both failure paths.","publishedAt":"2026-09-16T10:30:34.458Z","updatedAt":"2026-10-19T08:52:55.925Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"b88baab828713ce0b49b185444b2ee83bed373a8","status":"affected","lessThan":"ba42d8a1c2c7629c61914df11a7d63ac77449ffb","versionType":"git"},{"version":"b88baab828713ce0b49b185444b2ee83bed373a8","status":"affected","lessThan":"88114e3a96582882e63b2f73aa7a5a9cf0d5073c","versionType":"git"},{"version":"b88baab828713ce0b49b185444b2ee83bed373a8","status":"affected","lessThan":"24c25b182d17d1bdfde0088c96bdf6f93e8f46bc","versionType":"git"},{"version":"b88baab828713ce0b49b185444b2ee83bed373a8","status":"affected","lessThan":"4083d24c2636fde7b18076115af52820d203bc57","versionType":"git"},{"version":"b88baab828713ce0b49b185444b2ee83bed373a8","status":"affected","lessThan":"ccf930812f23b8259ef64fd3394d53b093e4651a","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/nouveau/nouveau_uvmm.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.6","versionType":"semver"},{"version":"6.6.157","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.110","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.51","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.5","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/nouveau/nouveau_uvmm.c"]}],"references":["https://git.kernel.org/stable/c/ba42d8a1c2c7629c61914df11a7d63ac77449ffb","https://git.kernel.org/stable/c/88114e3a96582882e63b2f73aa7a5a9cf0d5073c","https://git.kernel.org/stable/c/24c25b182d17d1bdfde0088c96bdf6f93e8f46bc","https://git.kernel.org/stable/c/4083d24c2636fde7b18076115af52820d203bc57","https://git.kernel.org/stable/c/ccf930812f23b8259ef64fd3394d53b093e4651a"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/89xxx/CVE-2026-89801.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89801","state":"PUBLISHED","datePublished":"2026-09-16T10:30:34.458Z","dateUpdated":"2026-10-19T08:52:55.925Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-11T19:38:34.767Z"},"containers":{"cna":{"title":"drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE\n\nIn nouveau_uvmm_bind_job_submit()'s OP_UNMAP_SPARSE arm, op->reg is set\nfrom nouveau_uvma_region_find(), which only looks the region up and takes\nno reference; a region's sole reference is its membership in\nuvmm->region_mt. Two failure paths leave op->reg set: the -ENOENT check\nwhen the region is busy, and the drm_gpuvm_sm_unmap_ops_create() failure.\nThe sibling nouveau_uvmm_sm_unmap_prepare() failure just below clears\nop->reg; these two do not.\n\nunwind_continue steps back one op, so the failing op is skipped by the\nunwind loop and its op->reg stays set. nouveau_uvmm_bind_job_cleanup()\nthen enters its if (op->reg) branch and calls nouveau_uvma_region_remove()\nand nouveau_uvma_region_put() on it, dropping the tree's sole reference\nand freeing a region this job never created. The comment above the\ncleanup loop documents the broken invariant: op->reg must be NULL on\nsubmit failure.\n\nThis frees a live region on an unrelated failure, reachable single-job\nwhen drm_gpuvm_sm_unmap_ops_create() returns -ENOMEM; if another job owns\nthe same region, its cleanup then removes and puts the freed region, a\nuse-after-free. Clear op->reg on both failure paths."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"b88baab828713ce0b49b185444b2ee83bed373a8","status":"affected","lessThan":"ba42d8a1c2c7629c61914df11a7d63ac77449ffb","versionType":"git"},{"version":"b88baab828713ce0b49b185444b2ee83bed373a8","status":"affected","lessThan":"88114e3a96582882e63b2f73aa7a5a9cf0d5073c","versionType":"git"},{"version":"b88baab828713ce0b49b185444b2ee83bed373a8","status":"affected","lessThan":"24c25b182d17d1bdfde0088c96bdf6f93e8f46bc","versionType":"git"},{"version":"b88baab828713ce0b49b185444b2ee83bed373a8","status":"affected","lessThan":"4083d24c2636fde7b18076115af52820d203bc57","versionType":"git"},{"version":"b88baab828713ce0b49b185444b2ee83bed373a8","status":"affected","lessThan":"ccf930812f23b8259ef64fd3394d53b093e4651a","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/nouveau/nouveau_uvmm.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.6","versionType":"semver"},{"version":"6.6.157","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.110","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.51","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.5","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/nouveau/nouveau_uvmm.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/ba42d8a1c2c7629c61914df11a7d63ac77449ffb"},{"url":"https://git.kernel.org/stable/c/88114e3a96582882e63b2f73aa7a5a9cf0d5073c"},{"url":"https://git.kernel.org/stable/c/24c25b182d17d1bdfde0088c96bdf6f93e8f46bc"},{"url":"https://git.kernel.org/stable/c/4083d24c2636fde7b18076115af52820d203bc57"},{"url":"https://git.kernel.org/stable/c/ccf930812f23b8259ef64fd3394d53b093e4651a"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through DRM_IOCTL_NOUVEAU_VM_BIND on a nouveau render node (/dev/dri/renderD*): nouveau_uvmm_ioctl_vm_bind → nouveau_job_submit → nouveau_uvmm_bind_job_submit. This is a local ioctl path, not a network, adjacent-radio, or physical-bus interface.\nAC:L - An attacker can MAP_SPARSE a region, submit an async OP_UNMAP_SPARSE that dirties it while holding op->reg, then a second OP_UNMAP_SPARSE on the same range (or two unmaps in one ioctl). The failing path leaves op->reg set and cleanup frees the live region. The attacker drives both jobs, so no condition is outside their control.\nPR:L - NOUVEAU_VM_INIT and NOUVEAU_VM_BIND are DRM_RENDER_ALLOW with no DRM_ROOT_ONLY or capability checks. Any unprivileged local user who can open the nouveau render node (typical render/video group) can trigger this without init-namespace root.\nUI:N - The attacker opens their own DRM client and issues VM_INIT/VM_BIND ioctls on that fd; no separate victim action such as mounting a filesystem or opening an attacker-controlled file is required.\nS:U - The use-after-free corrupts kernel heap state (struct nouveau_uvma_region) inside the host nouveau driver. Impact stays in the same kernel authority; this is not a VM escape or IOMMU/DMA isolation bypass.\nC:H - Cleanup of a failed OP_UNMAP_SPARSE drops the maple-tree's sole reference and kfree()s a live nouveau_uvma_region another job still holds in op->reg. That use-after-free of a kernel object enables disclosure of reused slab contents, so confidentiality is High.\nI:H - The owning job's later cleanup calls sparse-unref, mas_erase, complete_all, and kref_put on the already-freed region. Heap spraying can reuse that object to corrupt kernel pointers and hijack control flow, so integrity is High.\nA:H - Dereferencing the freed nouveau_uvma_region in nouveau_uvmm_bind_job_cleanup, maple-tree remove, or a later bind causes a kernel oops/panic; the attacker can repeat the sequence to crash or hang the system."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-19T08:52:55.925Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.157"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.12.110"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.18.51"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"7.2.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}