{"id":"CVE-2026-98511","kind":"vulnerability","aliases":["CVE-2026-98511"],"related":[],"title":"Linux kernel nouveau driver: failed re-pin leaves a stale pin count","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()\n\nnouveau_bo_pin_locked() checks whether an already pinned BO is in a\nmemory domain compatible with a new pin request. When the domains are\nincompatible, it sets -EBUSY but still calls ttm_bo_pin() before\nreturning.\n\nCallers treat a failed nouveau_bo_pin() as not having acquired a new pin,\nso the extra pin count is never decreased by a matching unpin.\nThis triggers the warning in ttm_bo_release():\n\n\tWARN_ON_ONCE(bo->pin_count);\n\nFound when fuzzing the nouveau driver with a modified Syzkaller:\n\n\tWARNING: drivers/gpu/drm/ttm/ttm_bo.c:256 at ttm_bo_release+0x827/0x9e0 drivers/gpu/drm/ttm/ttm_bo.c:256, CPU#1: syz.3.24/2212\n\tModules linked in:\n\tCPU: 1 UID: 0 PID: 2212 Comm: syz.3.24 Not tainted 7.2.0 #24 PREEMPT(lazy)\n\tnouveau 0000:01:00.0: gsp:msg fn:103 len:0x40/0x20 res:0x19 resp:0x19\n\tHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n\tRIP: 0010:ttm_bo_release+0x827/0x9e0 drivers/gpu/drm/ttm/ttm_bo.c:256\n\tCode: 02 00 0f 85 51 01 00 00 48 8b 7b 08 e8 d2 20 01 00 e9 80 fd ff ff e8 d8 15 c0 fe 90 0f 0b 90 e9 e1 f8 ff ff e8 ca 15 c0 fe 90 <0f> 0b 90 e9 a4 f8 ff ff e8 bc 15 c0 fe be 03 00 00 00 4c 89 e7 e8\n\tmsg: 00000000: 05 00 d0 c1 04 00 f0 f1 01 30 00 00 2d 90 00 00  .........0..-...\n\tRSP: 0018:ffffc9000f5cf710 EFLAGS: 00010293\n\tRAX: 0000000000000000 RBX: ffff888018e5d2a8 RCX: ffffffff82bb1b36\n\tRDX: ffff888017b68000 RSI: 0000000000000004 RDI: ffff888018e5d2a8\n\tmsg: 00000010: 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n\tRBP: ffff88801261c720 R08: 0000000000000001 R09: ffffed10031cba55\n\tR10: ffff888018e5d2ab R11: 00000000000000f3 R12: ffff888018e5d290\n\tR13: ffff888018e5d2d4 R14: ffff88801b219c18 R15: dffffc0000000000\n\tFS:  0000000000000000(0000) GS:ffff8880e0f6f000(0000) knlGS:0000000000000000\n\tCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n\tCR2: 0000001b31223ffc CR3: 0000000028e00005 CR4: 0000000000770ef0\n\tPKRU: 80000000\n\tCall Trace:\n\t<TASK>\n\tkref_put include/linux/kref.h:65 [inline]\n\tttm_bo_put drivers/gpu/drm/ttm/ttm_bo.c:325 [inline]\n\tttm_bo_fini+0x55/0x80 drivers/gpu/drm/ttm/ttm_bo.c:330\n\tnouveau_gem_object_del+0xb2/0x1b0 drivers/gpu/drm/nouveau/nouveau_gem.c:90\n\tdrm_gem_object_free+0x5f/0x90 drivers/gpu/drm/drm_gem.c:1165\n\tkref_put include/linux/kref.h:65 [inline]\n\t__drm_gem_object_put include/drm/drm_gem.h:562 [inline]\n\tdrm_gem_object_put include/drm/drm_gem.h:575 [inline]\n\tnouveau_abi16_chan_fini.constprop.0+0x44f/0x5a0 drivers/gpu/drm/nouveau/nouveau_abi16.c:195\n\tnouveau 0000:01:00.0: syz.2.23[2209]: Unknown handle 0x00000000\n\tnouveau_abi16_fini+0x1d0/0x340 drivers/gpu/drm/nouveau/nouveau_abi16.c:225\n\tnouveau_drm_postclose+0x18b/0x3e0 drivers/gpu/drm/nouveau/nouveau_drm.c:1284\n\tnouveau 0000:01:00.0: syz.2.23[2209]: validate_init\n\tdrm_file_free.part.0+0x6d6/0xb60 drivers/gpu/drm/drm_file.c:267\n\tdrm_file_free drivers/gpu/drm/drm_file.c:237 [inline]\n\tdrm_close_helper.isra.0+0x11a/0x160 drivers/gpu/drm/drm_file.c:290\n\tdrm_release+0x1ab/0x330 drivers/gpu/drm/drm_file.c:438\n\t__fput+0x39c/0xa60 fs/file_table.c:512\n\tnouveau 0000:01:00.0: syz.2.23[2209]: validate: -2\n\ttask_work_run+0x15a/0x230 kernel/task_work.c:233\n\texit_task_work include/linux/task_work.h:40 [inline]\n\tdo_exit+0x82b/0x25a0 kernel/exit.c:1009\n\tdo_group_exit+0xc2/0x280 kernel/exit.c:1152\n\tget_signal+0x1d6e/0x1f30 kernel/signal.c:3046\n\tarch_do_signal_or_restart+0x7d/0x6e0 arch/x86/kernel/signal.c:337\n\t__exit_to_user_mode_loop kernel/entry/common.c:66 [inline]\n\texit_to_user_mode_loop+0xdf/0x440 kernel/entry/common.c:101\n\t__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]\n\tsyscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]\n\tsyscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]\n\tdo_syscall_64+0x4f8/0x690 arch/x86/entry/syscall_64.c:100\n\tentry_SYSCALL_64_after_hwframe+0x77/0x7f\n\tRI\n---truncated---","summary":"When a GPU buffer is pinned again into an incompatible memory domain, the nouveau driver returns an error but still increments the pin count, so the count never returns to zero. On release this triggers a kernel WARN_ON splat seen while fuzzing, a crash-style denial of service rather than a code execution path described in the sources.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","linux","nouveau","nvidia-gpu"],"not_affected_if":["no-nvidia-gpu","proprietary-nvidia-driver"],"how_to_check":"- Run `uname -r` and check whether the kernel includes the nouveau fix for nouveau_bo_pin_locked() (unknown from the sources; check the distribution's kernel changelog for this CVE)\n- Confirm whether the nouveau driver is loaded with `lsmod | grep nouveau`","fix":"- Update the Linux kernel to a release that includes the upstream commit for drm/nouveau nouveau_bo_pin_locked() (fixed version unknown from the sources)","status":"open","published_at":"2026-10-18T16:17:02+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:23+00:00","updated_at":"2026-10-25T05:25:23+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:25:23Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit for drm/nouveau nouveau_bo_pin_locked() (fixed version unknown from the sources)","reach":"local","title":"Linux kernel nouveau driver: failed re-pin leaves a stale pin count","impact":"low","summary":"When a GPU buffer is pinned again into an incompatible memory domain, the nouveau driver returns an error but still increments the pin count, so the count never returns to zero. On release this triggers a kernel WARN_ON splat seen while fuzzing, a crash-style denial of service rather than a code execution path described in the sources.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","nvidia-gpu","nouveau"],"confidence":0.5,"needs_auth":"yes","worst_case":"local user triggers kernel WARN splat, possible kernel instability","analyst_note":"Check the kernel.org stable commit for nouveau_bo_pin_locked to confirm fixed kernel versions and whether any exploit beyond the WARN is possible.","how_to_check":"- Run `uname -r` and check whether the kernel includes the nouveau fix for nouveau_bo_pin_locked() (unknown from the sources; check the distribution's kernel changelog for this CVE)\n- Confirm whether the nouveau driver is loaded with `lsmod | grep nouveau`","needs_analyst":true,"not_affected_if":["no-nvidia-gpu","proprietary-nvidia-driver"],"who_is_affected":"Only machines that load the nouveau open-source driver for NVIDIA GPUs are in scope; the flaw is in a kernel GPU driver path reached by local applications using DRM. Servers without a GPU or using the proprietary NVIDIA driver are unlikely to be affected, though the sources do not state this explicitly.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000901,"input_tokens":5622,"output_tokens":678,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':207C,264C,445C,453C,461C,486C,502C,509C,523C,535C,541C,546C,561C,573C,580C,586C,595C,612C,644C,653C '-2':257C,557C '-2026':15A,18A '-98511':16A,19A '0':220C,351C,485C,522C,534C '00':270C,275C,276C,285C,326C,327C,328C,336C,340C,345C,346C,349C,350C,372C,373C,374C,375C,376C,377C,378C,379C,380C,381C,382C,383C,384C,385C,386C '00.0':234C,493C,516C,553C '0000':232C,407C,410C,416C,418C,491C,514C,551C '00000000':334C '0000000000000000':358C,406C,412C '0000000000000001':390C '0000000000000004':366C '00000000000000f3':396C '0000000000770ef0':426C '0000000028e00005':424C '0000000080050033':420C '00000010':370C '0000001b31223ffc':422C '00010293':356C '0010':260C,414C '0018':353C '01':233C,274C,284C,343C,492C,515C,552C '02':269C '03':325C '04':339C '04/01/2014':258C '05':335C '08':280C '0b':298C,312C '0f':271C,297C,311C '0x00000000':498C '0x19':242C,244C '0x40/0x20':240C '1':212C,218C '1.16.3':254C,256C '100':647C '1009':576C '101':615C '103':238C '1152':583C '1165':464C '1284':512C '15':293C,307C,321C '19':371C '195':489C '20':283C '2009':252C '207':622C '2209':495C,518C,555C '2212':222C '225':505C '230':631C '233':564C '237':531C '24':228C '256':202C,210C,267C '267':526C '290':538C '2d':347C '30':344C '3046':589C '318':639C '325':440C '330':448C '337':598C '40':569C '438':544C '48':277C '4c':329C '51':273C '512':549C '562':475C '575':482C '64':643C,650C '65':434C,468C '66':605C '7.2.0':227C '7b':279C '80':287C '80000000':428C '85':272C '89':330C '8b':278C '90':296C,299C,310C,313C,348C,456C 'a4':315C 'abi16':500C 'acquir':160C 'alreadi':120C 'arch':590C 'arch/x86/entry/syscall_64.c':646C 'arch/x86/kernel/signal.c':597C 'bc':320C 'bio':253C 'bo':110C,114C,122C,146C,155C,182C,187C,205C,262C,437C,443C 'buffer':30B 'bump':100C 'c0':294C,308C,322C 'c1':338C 'ca':306C 'call':144C,429C 'caller':150C 'check':117C 'code':80B,268C 'comm':223C 'compat':128C 'count':13A,50B,53B,102C,168C,189C 'cpu':211C,217C 'cr0':419C 'cr2':421C 'cr3':423C 'cr4':425C 'crash':72B 'crash-styl':71B 'cs':413C 'cve':14A,17A 'd0':337C 'd2':282C 'd8':292C 'debian':255C 'decreas':171C 'del':452C 'denial':74B 'describ':83B 'dffffc0000000000':404C 'domain':38B,127C,136C 'driver':4A,41B,195C 'drivers/gpu/drm/drm_file.c':525C,530C,537C,543C 'drivers/gpu/drm/drm_gem.c':463C 'drivers/gpu/drm/nouveau/nouveau_abi16.c':488C,504C 'drivers/gpu/drm/nouveau/nouveau_drm.c':511C 'drivers/gpu/drm/nouveau/nouveau_gem.c':455C 'drivers/gpu/drm/ttm/ttm_bo.c':201C,209C,266C,439C,447C 'drm':457C,470C,477C,507C,527C,539C 'drm/nouveau':97C 'drm_close_helper.isra':533C 'drm_file_free.part':521C 'ds':415C 'e1':301C 'e7':331C 'e8':281C,291C,305C,319C,332C 'e9':286C,300C,314C 'ebusi':141C 'eflag':355C 'entri':648C 'error':44B 'es':417C 'execut':81B 'exit':565C,572C,579C,599C,607C,616C,625C,634C 'extra':166C 'f0':341C 'f1':342C 'f8':302C,316C 'fail':5A,104C,153C 'fd':288C 'fe':295C,309C,323C 'ff':289C,290C,303C,304C,317C,318C 'ffff88801261c720':388C 'ffff888017b68000':364C 'ffff888018e5d290':398C 'ffff888018e5d2a8':360C,368C 'ffff888018e5d2ab':394C 'ffff888018e5d2d4':400C 'ffff88801b219c18':402C 'ffff8880e0f6f000':409C 'ffffc9000f5cf710':354C 'ffffed10031cba55':392C 'ffffffff82bb1b36':362C 'file':528C 'fini':444C,501C 'fn':237C 'follow':92C 'found':190C 'fput':545C 'free':460C,529C 'fs':405C 'fs/file_table.c':548C 'fuzz':69B,192C 'gem':450C,458C,471C,478C 'get':584C 'gpu':26B,29B 'group':578C 'gs':408C 'gsp':235C 'handl':497C 'hardwar':245C 'hwframe':652C 'ich9':251C 'include/drm/drm_gem.h':474C,481C 'include/linux/entry-common.h':638C 'include/linux/irq-entry-common.h':621C,630C 'include/linux/kref.h':433C,467C 'include/linux/task_work.h':568C 'incompat':36B,138C 'increment':47B 'infrastructur':20B 'init':520C 'inlin':435C,441C,469C,476C,483C,532C,570C,606C,623C,632C,640C 'kernel':2A,21B,63B,90C 'kernel/entry/common.c':604C,614C 'kernel/exit.c':575C,582C 'kernel/signal.c':588C 'kernel/task_work.c':563C 'knlgs':411C 'kref':431C,465C 'lazi':230C 'leav':9A 'len':239C 'link':215C 'linux':1A,22B,89C 'lock':112C,116C 'loop':603C,611C 'match':174C 'memori':37B,126C 'mode':602C,610C,619C,628C,637C 'modifi':198C 'modul':214C 'msg':236C,333C,369C 'name':246C 'never':54B,170C 'new':131C,162C 'nouveau':3A,23B,40B,109C,113C,154C,194C,231C,449C,490C,499C,506C,513C,550C 'nouveau_abi16_chan_fini.constprop':484C 'nvidia':25B 'nvidia-gpu':24B 'object':451C,459C,472C,479C 'path':82B 'pc':249C 'pid':221C 'pin':8A,12A,32B,49B,101C,107C,111C,115C,121C,132C,147C,156C,163C,167C,188C 'pkru':427C 'postclos':508C 'preempt':229C 'prepar':620C,629C 'put':432C,438C,466C,473C,480C 'q35':250C 'qemu':247C 'r08':389C 'r09':391C 'r10':393C 'r11':395C 'r12':397C 'r13':399C 'r14':401C 'r15':403C 'rather':77B 'rax':357C 'rbp':387C 'rbx':359C 'rcx':361C 'rdi':367C 'rdx':363C 're':7A,106C 're-pin':6A,105C 'releas':59B,183C,206C,263C,540C 'request':133C 'res':241C 'resolv':96C 'resp':243C 'restart':594C 'return':42B,55B,149C 'ri':655C 'rip':259C 'rsi':365C 'rsp':352C 'run':560C 'seen':67B 'servic':76B 'set':140C 'signal':585C,592C 'sourc':86B 'splat':66B 'stale':11A 'standard':248C 'still':46B,143C 'style':73B 'syscal':624C,633C,642C,649C 'syz.2.23':494C,517C,554C 'syz.3.24':224C 'syz.3.24/2212':213C 'syzkal':199C 'taint':226C 'task':558C,566C 'trace':430C 'treat':151C 'trigger':61B,177C 'truncat':656C 'ttm':145C,181C,204C,261C,436C,442C 'uid':219C 'unknown':496C 'unpin':175C 'user':601C,609C,618C,627C,636C 'valid':519C,556C 'vulner':93C 'warn':64B,179C,184C,200C 'whether':118C 'work':559C,567C 'x11a/0x160':536C 'x15a/0x230':562C 'x18b/0x3e0':510C 'x1ab/0x330':542C 'x1d0/0x340':503C 'x1d6e/0x1f30':587C 'x39c/0xa60':547C 'x44f/0x5a0':487C 'x4f8/0x690':645C 'x55/0x80':446C 'x5f/0x90':462C 'x6d6/0xb60':524C 'x77/0x7f':654C 'x7d/0x6e0':596C 'x827/0x9e0':208C,265C 'x82b/0x25a0':574C 'xb2/0x1b0':454C 'xc2/0x280':581C 'xdf/0x440':613C 'zero':57B","nicknames":[],"mitigations":[],"who_affected":"Only machines that load the nouveau open-source driver for NVIDIA GPUs are in scope; the flaw is in a kernel GPU driver path reached by local applications using DRM. Servers without a GPU or using the proprietary NVIDIA driver are unlikely to be affected, though the sources do not state this explicitly.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:02+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98511","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98511","severity":null,"published_at":"2026-10-18T16:17:02+00:00","modified_at":"2026-10-19T10:19:04+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}