---
id: "CVE-2026-98518"
kind: "vulnerability"
aliases: ["CVE-2026-98518"]
title: "Linux kernel: Nouveau GPU memory migration can address VRAM outside its buffer"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["linux-kernel", "nouveau", "nvidia-gpu", "runtime", "workstations"]
not_affected_if: ["no-nouveau-loaded", "proprietary-nvidia-driver"]
published_at: "2026-10-18T16:17:03+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T05:25:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98518", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# Linux kernel: Nouveau GPU memory migration can address VRAM outside its buffer

The Nouveau DRM driver registers a device-private memory region larger than the VRAM buffer object that backs it, so pages beyond the first chunk resolve to VRAM outside that buffer. The sources do not state the resulting attacker capability, so the exact impact is unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the kernel version with `uname -r` and whether the `nouveau` module is loaded with `lsmod | grep nouveau`
- Confirm the patch is present by looking for the commit that sizes the buffer object to the registered region in the kernel source tree (sources do not give a commit id)

## Fix

- Update the Linux kernel to a release that includes the upstream fix for drm/nouveau/dmem (version unknown from sources)

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98518

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau/dmem: pin VRAM for the whole registered range

Commit c32287471077 ("gpu/drm/nouveau: enable THP support for GPU memory
migration") grew the device-private region that
nouveau_dmem_chunk_alloc() registers from DMEM_CHUNK_SIZE to
DMEM_CHUNK_SIZE * NR_CHUNKS, but left the VRAM buffer object backing that
region at DMEM_CHUNK_SIZE.

nouveau_dmem_page_addr() returns chunk->bo->offset plus the page's offset
within the registered region, so every page past the first chunk resolves
to VRAM outside the buffer object.

Size the buffer object to the region it backs.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_