CVE-2026-52904

Analyzed Analyzed - Analysis Complete

Memory Leak in Nouveau Linux Kernel Driver

Publication date: 2026-06-09

Last updated on: 2026-07-08

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix nvkm_device leak on aperture removal failure When aperture_remove_conflicting_pci_devices() fails during probe, the error path returns directly without unwinding the nvkm_device that was just allocated by nvkm_device_pci_new(). This leaks both the device wrapper and the pci_enable_device() reference taken inside it. Jump to the existing fail_nvkm label so nvkm_device_del() runs and balances both. The leak was introduced when the intermediate nvkm_device_del() between detection and aperture removal was dropped in favor of creating the pci device once.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-09

Last Modified

2026-07-08

Generated

2026-07-20

AI Q&A

2026-06-09

EPSS Evaluated

2026-07-18

NVD

CVE-2026-52904

EUVD

EUVD-2026-35433

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.13 (inc) to 6.18.27 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.4 (exc)
linux	linux_kernel	From 6.12 (inc) to 6.12.86 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability occurs in the Linux kernel's drm/nouveau component. Specifically, when the function aperture_remove_conflicting_pci_devices() fails during the device probe process, the error handling path returns immediately without properly cleaning up the nvkm_device that was just allocated. This results in a resource leak of both the device wrapper and the PCI device reference.

The root cause is that the cleanup function nvkm_device_del() is not called in the failure path, which would normally release these resources. This leak was introduced when an intermediate cleanup step was removed in favor of creating the PCI device once.

Impact Analysis

This vulnerability can lead to resource leaks in the Linux kernel when the drm/nouveau driver fails to properly clean up after a failed device probe. Over time, such leaks may consume system resources unnecessarily, potentially leading to degraded system performance or stability issues.

Mitigation Strategies

The vulnerability is fixed in the Linux kernel by correcting the error handling in the drm/nouveau driver to prevent nvkm_device leaks. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Hi! I’m here to help you understand CVE-2026-52904. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70