CVE-2026-52904: drm/nouveau: fix nvkm_device leak on aperture removal failure
In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau: fix nvkmdevice leak on aperture removal failure
When apertureremoveconflictingpcidevices() fails during probe, the error path returns directly without unwinding the nvkmdevice that was just allocated by nvkmdevicepcinew(). This leaks both the device wrapper and the pcienabledevice() reference taken inside it.
Jump to the existing failnvkm label so nvkmdevicedel() runs and balances both. The leak was introduced when the intermediate nvkmdevicedel() between detection and aperture removal was dropped in favor of creating the pci device once.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52904?
CVE-2026-52904 has a risk rating of 12.
What does CVE-2026-52904 affect?
CVE-2026-52904 affects the Linux kernel specifically in the drm/nouveau module.
How do I fix CVE-2026-52904?
To fix CVE-2026-52904, update your Linux kernel to the latest version that addresses this vulnerability.
When was CVE-2026-52904 published?
CVE-2026-52904 was published on June 9, 2026.
What issue does CVE-2026-52904 resolve?
CVE-2026-52904 resolves a leak in nvkm_device during aperture removal failure in the Linux kernel.