CVE-2026-46006: drm/nouveau: fix u32 overflow in pushbuf reloc bounds check

Q: What access does an attacker need to exploit this issue?

The vulnerability is rated with local attack vector and low privileges required. No user interaction is required.

Q: Which systems are exposed?

Systems running the Linux kernel's drm/nouveau driver are affected. Microsoft azl3 kernel version 6.6.139.1-1 is also listed as affected.

Q: What is the impact of successful exploitation?

The provided severity vector indicates potential high impact to confidentiality, integrity, and availability within the affected security scope.

Q: What condition triggers the flawed bounds check?

A relocation buffer offset near the maximum __u32 value can cause adding 4 to wrap in 32-bit arithmetic before comparison with the buffer-object size. The fix performs this addition using 64-bit arithmetic.

Published May 27, 2026

Updated

drm/nouveau: fix u32 overflow in pushbuf reloc bounds check

Affected Software

8 affected componentsFixes available

Linux Linux kernel (drm/nouveau)

Linux Linux kernel>=2.6.34<5.15.209

Linux Linux kernel>=5.16<6.1.175

Linux Linux kernel>=6.2<6.6.140

Linux Linux kernel>=6.7<6.12.86

Linux Linux kernel>=6.13<6.18.27

Linux Linux kernel>=6.19<7.0.4

Microsoft azl3 kernel 6.6.139.1-1<6.6.141.1-1

6.6.141.1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1

Event History

May 27, 2026

CVE Published

via MITRE·12:56 PM

Data Sourced

via MITRE·12:56 PM

DescriptionSeverity

Data Sourced

via NVD·02:17 PM

RemedyDescriptionSeverityWeaknessAffected Software

May 28, 2026

Data Sourced

via Microsoft·08:12 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The vulnerability is rated with local attack vector and low privileges required. No user interaction is required.

Which systems are exposed?

Systems running the Linux kernel's drm/nouveau driver are affected. Microsoft azl3 kernel version 6.6.139.1-1 is also listed as affected.

What is the impact of successful exploitation?

The provided severity vector indicates potential high impact to confidentiality, integrity, and availability within the affected security scope.

What condition triggers the flawed bounds check?

A relocation buffer offset near the maximum __u32 value can cause adding 4 to wrap in 32-bit arithmetic before comparison with the buffer-object size. The fix performs this addition using 64-bit arithmetic.

CVE-2026-46006: drm/nouveau: fix u32 overflow in pushbuf reloc bounds check

Affected Software

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which systems are exposed?

What is the impact of successful exploitation?

What condition triggers the flawed bounds check?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which systems are exposed?

What is the impact of successful exploitation?

What condition triggers the flawed bounds check?