{"id":"CVE-2026-98515","kind":"vulnerability","aliases":["CVE-2026-98515"],"related":[],"title":"Linux kernel nouveau driver: double-free in nvif_vmm_dtor on open failure","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: fix double-free in nvif_vmm_dtor\n\nOn failure, nouveau_cli_init() calls nouveau_cli_fini() to tear\nthe client down. Then, nouveau_drm_open() also enters into its\ncleanup path and calls nouveau_cli_fini() AGAIN. nouveau_cli_fini()\ncalls nouveau_vmm_fini():\n\n\tvoid\n\tnouveau_vmm_fini(struct nouveau_vmm *vmm)\n\t{\n\t\tnouveau_svmm_fini(&vmm->svmm);\n\t\tnvif_vmm_dtor(&vmm->vmm);\n\t\tvmm->cli = NULL;\n\t}\n\nInside nvif_vmm_dtor(), vmm->page is freed unconditionally:\n\n\tvoid\n\tnvif_vmm_dtor(struct nvif_vmm *vmm)\n\t{\n\t\tkfree(vmm->page);\n\t\tnvif_object_dtor(&vmm->object);\n\t}\n\nvmm->page is never cleared after being freed, so the second call of\nnvif_vmm_dtor() will cause a double-free.\n\nFound by fuzzing the nouveau driver with a modified Syzkaller:\n\n\tBUG: KASAN: double-free in nvif_vmm_dtor+0x31/0x50 drivers/gpu/drm/nouveau/nvif/vmm.c:194\n\tFree of addr ffff888010fcdc30 by task syz.0.173/2567\n\n\tCPU: 1 UID: 0 PID: 2567 Comm: syz.0.173 Not tainted 7.2.0 #24 PREEMPT(lazy)\n\tHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n\tCall Trace:\n\t<TASK>\n\t__dump_stack lib/dump_stack.c:94 [inline]\n\tdump_stack_lvl+0x95/0xe0 lib/dump_stack.c:120\n\tprint_address_description mm/kasan/report.c:378 [inline]\n\tprint_report+0xcb/0x5a0 mm/kasan/report.c:482\n\tkasan_report_invalid_free+0xaa/0xd0 mm/kasan/report.c:557\n\tcheck_slab_allocation+0xe4/0x110 mm/kasan/common.c:235\n\tkasan_slab_pre_free include/linux/kasan.h:199 [inline]\n\tslab_free_hook mm/slub.c:2622 [inline]\n\tslab_free mm/slub.c:6377 [inline]\n\tkfree+0x192/0x590 mm/slub.c:6692\n\tnvif_vmm_dtor+0x31/0x50 drivers/gpu/drm/nouveau/nvif/vmm.c:194\n\tnouveau_vmm_fini+0x16/0x50 drivers/gpu/drm/nouveau/nouveau_vmm.c:127\n\tnouveau_cli_fini+0x10e/0x210 drivers/gpu/drm/nouveau/nouveau_drm.c:225\n\tnouveau_drm_open+0x24e/0x740 drivers/gpu/drm/nouveau/nouveau_drm.c:1255\n\tdrm_file_alloc+0x5f2/0xad0 drivers/gpu/drm/drm_file.c:176\n\tdrm_open_helper+0x1d7/0x4a0 drivers/gpu/drm/drm_file.c:335\n\tdrm_open+0x190/0x3d0 drivers/gpu/drm/drm_file.c:388\n\tdrm_stub_open+0x1f2/0x460 drivers/gpu/drm/drm_drv.c:1211\n\tchrdev_open+0x21c/0x660 fs/char_dev.c:411\n\tdo_dentry_open+0x59d/0x12b0 fs/open.c:947\n\tvfs_open+0x82/0x390 fs/open.c:1052\n\tdo_open fs/namei.c:4700 [inline]\n\tpath_openat+0x2345/0x3420 fs/namei.c:4863\n\tdo_file_open+0x207/0x460 fs/namei.c:4892\n\tdo_sys_openat2+0xd1/0x1d0 fs/open.c:1368\n\tdo_sys_open fs/open.c:1374 [inline]\n\t__do_sys_openat fs/open.c:1390 [inline]\n\t__se_sys_openat fs/open.c:1385 [inline]\n\t__x64_sys_openat+0x144/0x200 fs/open.c:1385\n\tdo_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n\tdo_syscall_64+0x115/0x690 arch/x86/entry/syscall_64.c:94\n\tentry_SYSCALL_64_after_hwframe+0x77/0x7f\n\tRIP: 0033:0x7fc6d687594d\n\tCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\n\tRSP: 002b:00007fc6d5295008 EFLAGS: 00000246 ORIG_RAX: 0000000000000101\n\tRAX: ffffffffffffffda RBX: 00007fc6d6b06180 RCX: 00007fc6d687594d\n\tRDX: 0000000000022501 RSI: 0000200000000000 RDI: ffffffffffffff9c\n\tRBP: 00007fc6d691c303 R08: 0000000000000000 R09: 0000000000000000\n\tR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n\tR13: 00007fc6d6b06218 R14: 00007fc6d6b06180 R15: 00007ffd9451d760\n\t</TASK>\n\n\tAllocated by task 2567 on cpu 1 at 163.593900s:\n\tkasan_save_stack+0x24/0x50 mm/kasan/common.c:57\n\tkasan_save_track+0x17/0x60 mm/kasan/common.c:78\n\tpoison_kmalloc_redzone mm/kasan/common.c:398 [inline]\n\t__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415\n\tkasan_kmalloc include/linux/kasan.h:263 [inline]\n\t__do_kmalloc_node mm/slub.c:5334 [inline]\n\t__kmalloc_noprof+0x304/0x7c0 mm/slub.c:5359\n\t_kmalloc_noprof include/linux/slab.h:992 [inline]\n\tnvif_vmm_ctor+0x3c0/0x7e0 drivers/gpu/drm/nouveau/nvif/vmm.c:237\n\tnouveau_vmm_init+0x40/0x90 drivers/gpu/drm/nouveau/nouveau_vmm.c:134\n\tnouveau_cli_init+0x7b9/0\n---truncated---","summary":"When opening a nouveau GPU device fails, the driver tears down the client twice, and the second pass frees a memory pointer that was already freed. A local user who can open the DRM device could trigger a kernel memory corruption bug.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","nouveau","nvidia-gpu","workstations"],"not_affected_if":["no-nvidia-gpu","nouveau-not-loaded"],"how_to_check":"- Run `uname -r` and check whether the kernel includes the upstream fix for drm/nouveau nvif_vmm_dtor, using the distribution's changelog or the kernel git log.\n- Check whether the nouveau module is loaded with `lsmod | grep nouveau`.","fix":"- Update the Linux kernel to a release that includes the upstream commit fixing drm/nouveau nvif_vmm_dtor (version unknown from the sources).\n- Until patched, unload or blacklist the nouveau driver if the machine does not need it (unknown from the sources).","status":"open","published_at":"2026-10-18T16:17:02+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:18+00:00","updated_at":"2026-10-25T05:25:18+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:25:18Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit fixing drm/nouveau nvif_vmm_dtor (version unknown from the sources).\n- Until patched, unload or blacklist the nouveau driver if the machine does not need it (unknown from the sources).","reach":"local","title":"Linux kernel nouveau driver: double-free in nvif_vmm_dtor on open failure","impact":"high","summary":"When opening a nouveau GPU device fails, the driver tears down the client twice, and the second pass frees a memory pointer that was already freed. A local user who can open the DRM device could trigger a kernel memory corruption bug.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","nvidia-gpu","nouveau","workstations"],"confidence":0.6,"needs_auth":"unknown","worst_case":"local user corrupts kernel memory, possibly escalating privileges","analyst_note":"Confirm affected and fixed kernel versions and the upstream fix commit from the NVD entry and kernel.org stable advisories.","how_to_check":"- Run `uname -r` and check whether the kernel includes the upstream fix for drm/nouveau nvif_vmm_dtor, using the distribution's changelog or the kernel git log.\n- Check whether the nouveau module is loaded with `lsmod | grep nouveau`.","needs_analyst":true,"not_affected_if":["nouveau-not-loaded","no-nvidia-gpu"],"who_is_affected":"Machines running the Linux kernel with the nouveau driver for NVIDIA GPUs, where a local user can open the DRM device node. Systems without NVIDIA hardware using nouveau, or with nouveau not loaded, can skip it. The sources do not say which kernel versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000901,"input_tokens":5720,"output_tokens":659,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':215C,264C,276C,284C,291C,314C,321C,328C,335C,342C,349C,356C,362C,369C,375C,382C,388C,399C,406C,413C,438C,451C,460C,581C,588C,600C,617C,629C,636C,643C '-2':252C '-2026':16A,19A '-98515':17A,20A '0':229C '00':473C,474C,475C,476C,477C '0000000000000000':553C,555C,557C,561C '0000000000000101':537C '0000000000000246':559C '0000000000022501':545C '00000246':534C '0000200000000000':547C '00007fc6d5295008':532C '00007fc6d687594d':543C '00007fc6d691c303':551C '00007fc6d6b06180':541C,565C '00007fc6d6b06218':563C '00007ffd9451d760':567C '002b':531C '0033':463C '01':510C,515C,528C '04/01/2014':253C '05':507C '08':505C '0f':470C,480C,506C '0x7fc6d687594d':464C '1':227C,574C '1.16.3':249C,251C '1052':391C '120':267C '1211':372C '1255':345C '127':331C '134':639C '1368':416C '1374':421C '1385':433C,441C '1390':427C '163.593900':576C '176':352C '194':218C,324C '199':300C '1e':481C '1f':471C '2009':247C '225':338C '235':294C '237':632C '24':237C,504C '2567':231C,571C '2622':306C '263':607C '2e':469C '335':359C '378':272C '388':365C '398':596C '3d':509C '411':378C '415':603C '4700':395C '48':483C,486C,489C,492C,508C,517C,529C '482':279C '4863':402C '4892':409C '4c':501C,503C '4d':495C,498C '5334':613C '5359':620C '557':287C '57':584C '63':446C '6377':311C '64':450C,457C,526C '66':468C '6692':317C '7.2.0':236C '73':514C '78':591C '84':472C '89':484C,487C,490C,493C,496C,499C,527C '8b':502C '90':478C '94':259C,454C '947':385C '992':624C 'addr':221C 'address':269C 'alloc':290C,348C,568C 'alreadi':54B 'also':109C 'arch/x86/entry/syscall_64.c':445C,453C 'b0':520C 'bio':248C 'bug':71B,206C 'c1':519C 'c2':497C 'c3':467C,516C 'c7':518C 'c8':500C 'ca':494C 'call':96C,116C,124C,185C,254C 'caus':191C 'check':288C 'chrdev':373C 'cleanup':113C 'clear':178C 'cli':94C,98C,118C,122C,147C,333C,641C 'client':42B,103C 'code':465C 'comm':232C 'corrupt':70B 'could':65B 'cpu':226C,573C 'ctor':628C 'cve':15A,18A 'd6':491C 'd8':525C 'debian':250C 'dentri':380C 'descript':270C 'devic':35B,64B 'doubl':6A,85C,194C,209C 'double-fre':5A,84C,193C,208C 'driver':4A,38B,201C 'drivers/gpu/drm/drm_drv.c':371C 'drivers/gpu/drm/drm_file.c':351C,358C,364C 'drivers/gpu/drm/nouveau/nouveau_drm.c':337C,344C 'drivers/gpu/drm/nouveau/nouveau_vmm.c':330C,638C 'drivers/gpu/drm/nouveau/nvif/vmm.c':217C,323C,631C 'drm':63B,107C,340C,346C,353C,360C,366C 'drm/nouveau':82C 'dtor':11A,90C,143C,152C,161C,171C,189C,214C,320C 'dump':256C,261C 'eflag':533C 'enter':110C 'entri':455C 'f0':511C 'f3':479C 'f7':488C,524C 'f8':485C 'fa':482C 'fail':36B 'failur':14A,92C 'ff':466C,512C,513C,521C,522C,523C 'ffff888010fcdc30':222C 'ffffffffffffff9c':549C 'ffffffffffffffda':539C 'file':347C,404C 'fini':99C,119C,123C,127C,131C,138C,327C,334C 'fix':83C 'follow':77C 'found':196C 'free':7A,48B,86C,195C,210C,219C,283C,298C,303C,309C 'freed':55B,156C,181C 'fs/char_dev.c':377C 'fs/namei.c':394C,401C,408C 'fs/open.c':384C,390C,415C,420C,426C,432C,440C 'fuzz':198C 'gpu':28B,34B 'hardwar':240C 'helper':355C 'hook':304C 'hwframe':459C 'ich9':246C 'include/linux/kasan.h':299C,606C 'include/linux/slab.h':623C 'infrastructur':21B 'init':95C,635C,642C 'inlin':260C,273C,301C,307C,312C,396C,422C,428C,434C,447C,597C,608C,614C,625C 'insid':149C 'invalid':282C 'kasan':207C,280C,295C,578C,585C,598C,604C 'kernel':2A,24B,68B,75C 'kfree':166C,313C 'kmalloc':593C,599C,605C,610C,615C,621C 'lazi':239C 'lib/dump_stack.c':258C,266C 'linux':1A,23B,74C 'linux-kernel':22B 'local':57B 'lvl':263C 'memori':50B,69B 'mm/kasan/common.c':293C,583C,590C,595C,602C 'mm/kasan/report.c':271C,278C,286C 'mm/slub.c':305C,310C,316C,612C,619C 'modifi':204C 'name':241C 'never':177C 'node':611C 'noprof':616C,622C 'nouveau':3A,25B,33B,93C,97C,106C,117C,121C,125C,129C,133C,136C,200C,325C,332C,339C,633C,640C 'null':148C 'nvidia':27B 'nvidia-gpu':26B 'nvif':9A,88C,141C,150C,159C,163C,169C,187C,212C,318C,626C 'object':170C,173C 'open':13A,31B,61B,108C,341C,354C,361C,368C,374C,381C,387C,393C,405C,419C 'openat':398C,425C,431C,437C 'openat2':412C 'orig':535C 'page':154C,168C,175C 'pass':47B 'path':114C,397C 'pc':244C 'pid':230C 'pointer':51B 'poison':592C 'pre':297C 'preempt':238C 'print':268C,274C 'q35':245C 'qemu':242C 'r08':552C 'r09':554C 'r10':556C 'r11':558C 'r12':560C 'r13':562C 'r14':564C 'r15':566C 'rax':536C,538C 'rbp':550C 'rbx':540C 'rcx':542C 'rdi':548C 'rdx':544C 'redzon':594C 'report':275C,281C 'resolv':81C 'rip':462C 'rsi':546C 'rsp':530C 'save':579C,586C 'se':429C 'second':46B,184C 'slab':289C,296C,302C,308C 'stack':257C,262C,580C 'standard':243C 'struct':132C,162C 'stub':367C 'svmm':137C,140C 'sys':411C,418C,424C,430C,436C 'syscal':443C,449C,456C 'syz.0.173':233C 'syz.0.173/2567':225C 'syzkal':205C 'taint':235C 'task':224C,570C 'tear':39B,101C 'trace':255C 'track':587C 'trigger':66B 'truncat':645C 'twice':43B 'uid':228C 'uncondit':157C 'user':58B 'vfs':386C 'vmm':10A,89C,126C,130C,134C,135C,139C,142C,144C,145C,146C,151C,153C,160C,164C,165C,167C,172C,174C,188C,213C,319C,326C,627C,634C 'void':128C,158C 'vulner':78C 'workstat':29B 'x10e/0x210':336C 'x115/0x690':452C 'x144/0x200':439C 'x16/0x50':329C 'x17/0x60':589C 'x190/0x3d0':363C 'x192/0x590':315C 'x1d7/0x4a0':357C 'x1f2/0x460':370C 'x207/0x460':407C 'x21c/0x660':376C 'x2345/0x3420':400C 'x24/0x50':582C 'x24e/0x740':343C 'x304/0x7c0':618C 'x31/0x50':216C,322C 'x3c0/0x7e0':630C 'x40/0x90':637C 'x59d/0x12b0':383C 'x5f2/0xad0':350C 'x64':435C,444C 'x77/0x7f':461C 'x7b9/0':644C 'x82/0x390':389C 'x95/0xe0':265C 'xaa/0xb0':601C 'xaa/0xd0':285C 'xcb/0x5a0':277C 'xd1/0x1d0':414C 'xe4/0x110':292C","nicknames":[],"mitigations":[],"who_affected":"Machines running the Linux kernel with the nouveau driver for NVIDIA GPUs, where a local user can open the DRM device node. Systems without NVIDIA hardware using nouveau, or with nouveau not loaded, can skip it. The sources do not say which kernel versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:02+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98515","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98515","severity":null,"published_at":"2026-10-18T16:17:02+00:00","modified_at":"2026-10-19T10:19:05+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}