CVE-2026-52904
Received Received - Intake
Memory Leak in Nouveau Linux Kernel Driver

Publication date: 2026-06-09

Last updated on: 2026-06-09

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix nvkm_device leak on aperture removal failure When aperture_remove_conflicting_pci_devices() fails during probe, the error path returns directly without unwinding the nvkm_device that was just allocated by nvkm_device_pci_new(). This leaks both the device wrapper and the pci_enable_device() reference taken inside it. Jump to the existing fail_nvkm label so nvkm_device_del() runs and balances both. The leak was introduced when the intermediate nvkm_device_del() between detection and aperture removal was dropped in favor of creating the pci device once.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-09
Last Modified
2026-06-09
Generated
2026-06-09
AI Q&A
2026-06-09
EPSS Evaluated
N/A
NVD
CVE-2026-52904
EUVD
EUVD-2026-35433
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability occurs in the Linux kernel's drm/nouveau component. Specifically, when the function aperture_remove_conflicting_pci_devices() fails during the device probe process, the error handling path returns immediately without properly cleaning up the nvkm_device that was just allocated. This results in a resource leak of both the device wrapper and the PCI device reference.

The root cause is that the cleanup function nvkm_device_del() is not called in the failure path, which would normally release these resources. This leak was introduced when an intermediate cleanup step was removed in favor of creating the PCI device once.

Impact Analysis

This vulnerability can lead to resource leaks in the Linux kernel when the drm/nouveau driver fails to properly clean up after a failed device probe. Over time, such leaks may consume system resources unnecessarily, potentially leading to degraded system performance or stability issues.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52904. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart