{"id":"CVE-2026-98517","kind":"vulnerability","aliases":["CVE-2026-98517"],"related":[],"title":"Linux kernel nouveau driver: use-after-free when buffer sits in system memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM\n\nnouveau_uvmm_sm() calls op_map(), which passes bo->resource through\nnouveau_mem() to nouveau_uvma_map(). nouveau_uvmm_vmm_map() then reads\nmem->mem.type.\n\nBut this is only valid when bo->resource is backed by struct nouveau_mem,\nas is the case for VRAM and TT resources. If the BO is left in\nTTM_PL_SYSTEM, bo->resource is only a struct ttm_resource. Treating it\nas struct nouveau_mem makes the mem->mem.type read past the end of the\nresource, causing a KASAN: slab-use-after-free Read in nouveau_uvmm_sm\nreport:\n\nBUG: KASAN: slab-use-after-free in nouveau_uvmm_vmm_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:152 [inline]\nBUG: KASAN: slab-use-after-free in nouveau_uvma_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:199 [inline]\nBUG: KASAN: slab-use-after-free in op_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:849 [inline]\nBUG: KASAN: slab-use-after-free in nouveau_uvmm_sm.constprop.0+0x6ab/0x900 drivers/gpu/drm/nouveau/nouveau_uvmm.c:903\nRead of size 1 at addr ffff888127d3e3a0 by task kworker/0:1/11\n\nCPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 7.2.0 #5 PREEMPT(lazy)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nWorkqueue: nouveau_sched_wq_2224 drm_sched_run_job_work\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x95/0xe0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xcb/0x5a0 mm/kasan/report.c:482\n kasan_report+0xca/0x100 mm/kasan/report.c:595\n nouveau_uvmm_vmm_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:152 [inline]\n nouveau_uvma_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:199 [inline]\n op_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:849 [inline]\n nouveau_uvmm_sm.constprop.0+0x6ab/0x900 drivers/gpu/drm/nouveau/nouveau_uvmm.c:903\n nouveau_uvmm_sm_unmap drivers/gpu/drm/nouveau/nouveau_uvmm.c:932 [inline]\n nouveau_uvmm_bind_job_run+0xd6/0x250 drivers/gpu/drm/nouveau/nouveau_uvmm.c:1532\n nouveau_job_run drivers/gpu/drm/nouveau/nouveau_sched.c:350 [inline]\n nouveau_sched_run_job+0x62/0xd0 drivers/gpu/drm/nouveau/nouveau_sched.c:364\n drm_sched_run_job_work+0x356/0xa10 drivers/gpu/drm/scheduler/sched_main.c:1061\n process_one_work+0x8a5/0x1900 kernel/workqueue.c:3322\n process_scheduled_works kernel/workqueue.c:3405 [inline]\n worker_thread+0x5dd/0xd80 kernel/workqueue.c:3486\n kthread+0x31d/0x420 kernel/kthread.c:436\n ret_from_fork+0x662/0x940 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n </TASK>\n\nAllocated by task 2224 on cpu 0 at 66.550027s:\n kasan_save_stack+0x24/0x50 mm/kasan/common.c:57\n kasan_save_track+0x17/0x60 mm/kasan/common.c:78\n poison_kmalloc_redzone mm/kasan/common.c:398 [inline]\n __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415\n kasan_kmalloc include/linux/kasan.h:263 [inline]\n __do_kmalloc_node mm/slub.c:5334 [inline]\n __kmalloc_noprof+0x304/0x7c0 mm/slub.c:5359\n _kmalloc_noprof include/linux/slab.h:992 [inline]\n dma_resv_list_alloc+0x27/0x90 drivers/dma-buf/dma-resv.c:106\n dma_resv_reserve_fences+0x60e/0xa30 drivers/dma-buf/dma-resv.c:205\n ttm_bo_alloc_resource+0x12c/0xbd0 drivers/gpu/drm/ttm/ttm_bo.c:721\n ttm_bo_validate+0x1bc/0x4a0 drivers/gpu/drm/ttm/ttm_bo.c:856\n ttm_bo_init_reserved+0x2c3/0x570 drivers/gpu/drm/ttm/ttm_bo.c:970\n nouveau_bo_init+0x159/0x2c0 drivers/gpu/drm/nouveau/nouveau_bo.c:359\n nouveau_gem_new+0x234/0x5f0 drivers/gpu/drm/nouveau/nouveau_gem.c:272\n nouveau_gem_ioctl_new+0x1eb/0x420 drivers/gpu/drm/nouveau/nouveau_gem.c:352\n drm_ioctl_kernel+0x192/0x350 drivers/gpu/drm/drm_ioctl.c:817\n drm_ioctl+0x4f8/0xb40 drivers/gpu/drm/drm_ioctl.c:914\n nouveau_drm_ioctl+0xea/0x2c0 drivers/gpu/drm/nouveau/nouveau_drm.c:1338\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x180/0x1d0 fs/ioctl.c:583\n do_syscall_x64 ar\n---truncated---","summary":"The nouveau GPU driver in the Linux kernel reads a memory-resource structure as if it were a larger type when a buffer object is in system memory, causing a KASAN-reported use-after-free in nouveau_uvmm_sm. The sources do not state the attacker-reachable impact beyond the crash report.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","linux","nouveau","nvidia-gpu"],"not_affected_if":["no-nouveau-driver","proprietary-nvidia-driver"],"how_to_check":"- Run `uname -r` and check whether the kernel includes the nouveau driver (`lsmod | grep nouveau`)\n- Check whether the running kernel build predates the upstream fix for drm/nouveau/uvmm, using the distribution's changelog\n- unknown whether the sources list a specific affected version range","fix":"- Update the Linux kernel to a release that includes the upstream drm/nouveau/uvmm fix (version not stated in the sources: unknown)\n- Reboot after installing the patched kernel","status":"open","published_at":"2026-10-18T16:17:03+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:17+00:00","updated_at":"2026-10-25T05:25:17+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:25:17Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream drm/nouveau/uvmm fix (version not stated in the sources: unknown)\n- Reboot after installing the patched kernel","reach":"local","title":"Linux kernel nouveau driver: use-after-free when buffer sits in system memory","impact":"medium","summary":"The nouveau GPU driver in the Linux kernel reads a memory-resource structure as if it were a larger type when a buffer object is in system memory, causing a KASAN-reported use-after-free in nouveau_uvmm_sm. The sources do not state the attacker-reachable impact beyond the crash report.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","nvidia-gpu","nouveau"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; sources report only a KASAN use-after-free read","analyst_note":"Check the upstream kernel.org commit for drm/nouveau/uvmm and the NVD entry to confirm fixed kernel versions and whether the bug is only reachable locally.","how_to_check":"- Run `uname -r` and check whether the kernel includes the nouveau driver (`lsmod | grep nouveau`)\n- Check whether the running kernel build predates the upstream fix for drm/nouveau/uvmm, using the distribution's changelog\n- unknown whether the sources list a specific affected version range","needs_analyst":true,"not_affected_if":["no-nouveau-driver","proprietary-nvidia-driver"],"who_is_affected":"Systems that load the nouveau open-source NVIDIA GPU driver and use the uvmm (GPU virtual memory) bind path, typically desktops, workstations or servers with NVIDIA GPUs running Linux. Systems without nouveau loaded, or using the proprietary NVIDIA driver, are unlikely to be affected; the sources do not confirm this beyond the driver path.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000927,"input_tokens":5705,"output_tokens":713,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':256C,320C,332C,338C,362C,378C,392C,401C,408C,420C,425C,432C,440C,457C,464C,476C,493C,506C,514C,522C,529C,537C,544C,551C,559C,566C,572C,579C,603C '-2':298C '-2026':16A,19A '-98517':17A,20A '0':255C,272C,274C,361C,450C '04/01/2014':299C '1':263C,279C '1.16.3':295C,297C '1/11':270C '106':509C '1061':404C '11':276C '120':323C '1338':582C '152':217C,347C '1532':381C '158':435C '199':231C,353C '2009':293C '205':517C '2224':304C,447C '245':443C '263':483C '272':554C '3322':411C '3405':416C '3486':423C '350':386C '352':562C '359':547C '364':395C '378':328C '398':472C '415':479C '436':428C '482':335C '5':283C '51':586C '5334':489C '5359':496C '57':460C '583':598C,606C '595':341C '597':592C '66.550027':452C '7.2.0':282C '721':525C '78':467C '817':569C '849':244C,358C '856':532C '903':259C,365C '914':575C '932':371C '94':315C '970':540C '992':500C 'addr':265C 'address':325C 'alloc':444C,505C,520C 'ar':610C 'arch/x86/entry/entry_64.s':442C 'arch/x86/kernel/process.c':434C 'asm':439C 'attack':77B 'attacker-reach':76B 'back':142C 'beyond':80B 'bind':375C 'bio':294C 'bo':102C,116C,139C,158C,165C,519C,527C,534C,542C 'buffer':10A,51B 'bug':204C,219C,233C,246C 'call':111C,310C 'case':150C 'caus':57B,190C 'comm':277C 'cpu':271C,449C 'crash':82B 'cve':15A,18A 'debian':296C 'descript':326C 'dma':502C,510C 'driver':4A,31B 'drivers/dma-buf/dma-resv.c':508C,516C 'drivers/gpu/drm/drm_ioctl.c':568C,574C 'drivers/gpu/drm/nouveau/nouveau_bo.c':546C 'drivers/gpu/drm/nouveau/nouveau_drm.c':581C 'drivers/gpu/drm/nouveau/nouveau_gem.c':553C,561C 'drivers/gpu/drm/nouveau/nouveau_sched.c':385C,394C 'drivers/gpu/drm/nouveau/nouveau_uvmm.c':216C,230C,243C,258C,346C,352C,357C,364C,370C,380C 'drivers/gpu/drm/scheduler/sched_main.c':403C 'drivers/gpu/drm/ttm/ttm_bo.c':524C,531C,539C 'drm':305C,396C,563C,570C,577C 'drm/nouveau/uvmm':94C 'dump':312C,317C 'end':186C 'fenc':513C 'ffff888127d3e3a0':266C 'fix':95C 'follow':89C 'fork':431C,438C 'free':8A,65B,197C,210C,225C,239C,252C 'fs/ioctl.c':585C,591C,597C,605C 'gem':549C,556C 'gpu':27B,30B 'hardwar':286C 'ich9':292C 'impact':79B 'include/linux/kasan.h':482C 'include/linux/slab.h':499C 'infrastructur':21B 'init':535C,543C 'inlin':218C,232C,245C,316C,329C,348C,354C,359C,372C,387C,417C,473C,484C,490C,501C,587C,593C,599C 'ioctl':557C,564C,571C,578C,584C,590C,596C,602C 'job':308C,376C,383C,391C,399C 'kasan':60B,192C,205C,220C,234C,247C,336C,454C,461C,474C,480C 'kasan-report':59B 'kernel':2A,22B,35B,87C,565C 'kernel/kthread.c':427C 'kernel/workqueue.c':410C,415C,422C 'kmalloc':469C,475C,481C,486C,491C,497C 'kthread':424C 'kworker/0':269C,278C 'larger':47B 'lazi':285C 'left':160C 'lib/dump_stack.c':314C,322C 'linux':1A,23B,34B,86C 'list':504C 'lvl':319C 'make':179C 'map':113C,124C,128C,215C,229C,242C,345C,351C,356C 'mem':120C,131C,146C,178C,181C 'mem.type':132C,182C 'memori':14A,39B,56B 'memory-resourc':38B 'mm/kasan/common.c':459C,466C,471C,478C 'mm/kasan/report.c':327C,334C,340C 'mm/slub.c':488C,495C 'name':287C 'new':550C,558C 'node':487C 'noprof':492C,498C 'nouveau':3A,24B,29B,67B,98C,108C,119C,122C,125C,145C,177C,200C,212C,227C,301C,342C,349C,366C,373C,382C,388C,541C,548C,555C,576C 'nouveau_uvmm_sm.constprop':254C,360C 'nvidia':26B 'nvidia-gpu':25B 'object':52B 'one':406C 'op':112C,241C,355C 'pass':115C 'past':184C 'pc':290C 'pid':275C 'pl':106C,163C 'poison':468C 'preempt':284C 'print':324C,330C 'process':405C,412C 'q35':291C 'qemu':288C 'reachabl':78B 'read':36B,130C,183C,198C,260C 'redzon':470C 'report':61B,83B,203C,331C,337C 'reserv':512C,536C 'resolv':93C 'resourc':40B,117C,140C,155C,166C,172C,189C,521C 'resv':503C,511C 'ret':429C,436C 'run':307C,377C,384C,390C,398C 'save':455C,462C 'sched':302C,306C,389C,397C 'schedul':413C 'se':594C 'sit':11A 'size':262C 'slab':194C,207C,222C,236C,249C 'slab-use-after-fre':193C,206C,221C,235C,248C 'sm':69B,100C,110C,202C,368C 'sourc':71B 'stack':313C,318C,456C 'standard':289C 'state':74B 'struct':144C,170C,176C 'structur':41B 'sys':589C,595C,601C 'syscal':608C 'system':13A,55B,107C,164C 'taint':281C 'task':268C,446C 'thread':419C 'trace':311C 'track':463C 'treat':173C 'truncat':611C 'tt':154C 'ttm':105C,162C,171C,518C,526C,533C 'type':48B 'uaf':96C 'uid':273C 'unmap':369C 'use':6A,63B,195C,208C,223C,237C,250C 'use-after-fre':5A,62B 'uvma':123C,228C,350C 'uvmm':68B,99C,109C,126C,201C,213C,343C,367C,374C 'valid':137C,528C 'vfs':583C 'vmm':127C,214C,344C 'vram':152C 'vulner':90C 'work':309C,400C,407C,414C 'worker':418C 'workqueu':300C 'wq':303C 'x12c/0xbd0':523C 'x159/0x2c0':545C 'x17/0x60':465C 'x180/0x1d0':604C 'x192/0x350':567C 'x1a/0x30':441C 'x1bc/0x4a0':530C 'x1eb/0x420':560C 'x234/0x5f0':552C 'x24/0x50':458C 'x27/0x90':507C 'x2c3/0x570':538C 'x304/0x7c0':494C 'x31d/0x420':426C 'x356/0xa10':402C 'x4f8/0xb40':573C 'x5dd/0xd80':421C 'x60e/0xa30':515C 'x62/0xd0':393C 'x64':600C,609C 'x662/0x940':433C 'x6ab/0x900':257C,363C 'x8a5/0x1900':409C 'x95/0xe0':321C 'xaa/0xb0':477C 'xca/0x100':339C 'xcb/0x5a0':333C 'xd6/0x250':379C 'xea/0x2c0':580C","nicknames":[],"mitigations":[],"who_affected":"Systems that load the nouveau open-source NVIDIA GPU driver and use the uvmm (GPU virtual memory) bind path, typically desktops, workstations or servers with NVIDIA GPUs running Linux. Systems without nouveau loaded, or using the proprietary NVIDIA driver, are unlikely to be affected; the sources do not confirm this beyond the driver path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:03+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98517","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98517","severity":null,"published_at":"2026-10-18T16:17:03+00:00","modified_at":"2026-10-21T13:21:32+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}