CVE-2026-98512

Received Received - Intake

Use-After-Free in Nouveau Linux Kernel Driver

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: RCU-free the scheduler-containing nouveau_sched struct nouveau_sched embeds a struct drm_gpu_scheduler (base). nouveau_sched_destroy() calls nouveau_sched_fini() (which does drm_sched_fini(&sched->base)) and then frees the object with plain kfree(sched). drm_sched_fence_get_timeline_name() returns fence->sched->name, and the scheduler fence keeps a .release callback so it is not ops-detached on signalling. A finished fence exported to userspace via drm_syncobj / sync_file therefore keeps pointing at &sched->base after nouveau_sched_destroy(), and a later get_timeline_name() -- reachable unprivileged through SYNC_IOC_FILE_INFO -- dereferences freed memory (KASAN slab-use-after-free read). Per the dma-fence lifetime contract the exporter must keep the data backing a signalled fence alive for an RCU grace period. Free the scheduler-containing object with kfree_rcu() instead of kfree().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98512

EUVD

EUVD-2026-103752

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	5f03a507b29e44a848f315c7240c19894dd8be4f
Linux	Linux	5f03a507b29e44a848f315c7240c19894dd8be4f
Linux	Linux	5f03a507b29e44a848f315c7240c19894dd8be4f
Linux	Linux	5f03a507b29e44a848f315c7240c19894dd8be4f
Linux	Linux	6.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's Nouveau DRM driver. It occurs when a scheduler object is freed with kfree() while a reference to it still exists in a userspace-accessible fence. The fence's release callback keeps pointing to freed memory, which can be accessed via SYNC_IOC_FILE_INFO, leading to a slab-use-after-free read.

Detection Guidance

This vulnerability is specific to the Linux kernel's Nouveau driver and involves a use-after-free issue in the DRM scheduler. Detection requires kernel-level inspection rather than network scanning. Check kernel logs for Nouveau-related errors or slab-use-after-free warnings using commands like dmesg | grep -i nouveau or journalctl -k | grep -i nouveau.

Impact Analysis

An unprivileged local attacker could exploit this to read sensitive kernel memory, potentially leading to information disclosure or privilege escalation. Systems using affected Nouveau DRM drivers are at risk.

Compliance Impact

This vulnerability involves a use-after-free flaw in the Linux kernel's Nouveau driver, which could allow unprivileged users to trigger a slab-use-after-free read. While it does not directly impact compliance with standards like GDPR or HIPAA, such memory corruption issues could potentially lead to unauthorized data access or system instability, indirectly affecting compliance by compromising data integrity or availability.

Mitigation Strategies

Apply the latest kernel updates from your Linux distribution to ensure the patched Nouveau driver is installed. If immediate patching is not possible, consider disabling the Nouveau driver by blacklisting it (add 'blacklist nouveau' to /etc/modprobe.d/blacklist.conf) and rebooting. This may impact NVIDIA GPU functionality.

Hi! I’m here to help you understand CVE-2026-98512. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70