Live › vulnerability › CVE-2026-98518
Go to dashboardThe Nouveau DRM driver registers a device-private memory region larger than the VRAM buffer object that backs it, so pages beyond the first chunk resolve to VRAM outside that buffer. The sources do not state the resulting attacker capability, so the exact impact is unknown.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the Nouveau driver and device-private memory migration (THP support for GPU memory migration) enabled, typically machines with NVIDIA GPUs using the open-source Nouveau driver rather than the proprietary driver. Systems without Nouveau loaded or without NVIDIA GPUs using it are likely not affected, but the sources do not confirm this.
No product ranges from the sources yet.
uname -r and whether the nouveau module is loaded with lsmod | grep nouveauEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau/dmem: pin VRAM for the whole registered range
Commit c32287471077 ("gpu/drm/nouveau: enable THP support for GPU memory migration") grew the device-private region that nouveau_dmem_chunk_alloc() registers from DMEM_CHUNK_SIZE to DMEM_CHUNK_SIZE * NR_CHUNKS, but left the VRAM buffer object backing that region at DMEM_CHUNK_SIZE.
nouveau_dmem_page_addr() returns chunk->bo->offset plus the page's offset within the registered region, so every page past the first chunk resolves to VRAM outside the buffer object.
Size the buffer object to the region it backs.
This page as .md · .json · in your agent: get_signal("CVE-2026-98518")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.