CVE-2026-68271
Received Received - Intake

Memory Leak and Kernel Oops in Nouveau DRM Driver

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix reversed error cleanup order in ucopy functions nouveau_uvmm_vm_bind_ucopy() and nouveau_exec_ucopy() place their error cleanup labels in allocation order rather than reverse allocation order. On a u_memcpya() failure for in_sync.s, the goto to err_free_ops (or err_free_pushs) frees the first allocation and then falls through to err_free_ins, which calls u_free() on args->in_sync.s. Since args->in_sync.s still holds the ERR_PTR returned by the failed u_memcpya(), and ERR_PTR values are not caught by ZERO_OR_NULL_PTR(), kvfree() proceeds to dereference it, which can result in a kernel oops. A failure for out_sync.s instead jumps to err_free_ins and skips freeing the first allocation, leading to a memory leak. Fix by swapping the cleanup label order so resources are freed in the correct reverse allocation sequence.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68271
EUVD
EUVD-2026-55372

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the Nouveau DRM driver. It involves incorrect error cleanup in two functions, nouveau_uvmm_vm_bind_ucopy() and nouveau_exec_ucopy(). When memory allocation fails, the cleanup process frees resources in the wrong order, leading to a kernel oops or memory leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's Nouveau DRM driver and requires kernel-level detection. Check if your kernel version includes the affected Nouveau ucopy functions by inspecting kernel logs for Nouveau-related errors or oops messages. Use commands like dmesg | grep -i nouveau or journalctl -k | grep -i nouveau to search for anomalies.

Impact Analysis

This vulnerability can cause system instability, including kernel crashes (oops) or memory leaks. If exploited, it may lead to denial-of-service conditions or unexpected system behavior.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this issue. If immediate patching is not possible, consider disabling the Nouveau DRM driver if not required, using kernel parameters like nomodeset or disabling the module via modprobe.blacklist=nouveau.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68271. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart