CVE-2026-68271: drm/nouveau: fix reversed error cleanup order in ucopy functions
In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau: fix reversed error cleanup order in ucopy functions
nouveauuvmmvmbinducopy() and nouveauexecucopy() place their error cleanup labels in allocation order rather than reverse allocation order. On a umemcpya() failure for insync.s, the goto to errfreeops (or errfreepushs) frees the first allocation and then falls through to errfreeins, which calls ufree() on args->insync.s.
Since args->insync.s still holds the ERRPTR returned by the failed umemcpya(), and ERRPTR values are not caught by ZEROORNULLPTR(), kvfree() proceeds to dereference it, which can result in a kernel oops. A failure for outsync.s instead jumps to errfreeins and skips freeing the first allocation, leading to a memory leak.
Fix by swapping the cleanup label order so resources are freed in the correct reverse allocation sequence.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drm/nouveauto a version that resolves this vulnerability.Patch fix reversed error cleanup order in ucopy functions
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68271?
The severity of CVE-2026-68271 is classified as risk 34.
How does CVE-2026-68271 affect the Linux kernel?
CVE-2026-68271 affects the Linux kernel by having a reversed error cleanup order in the ucopy functions.
How do I fix CVE-2026-68271?
To fix CVE-2026-68271, you should update to the latest version of the Linux kernel where this vulnerability has been resolved.
What are the specific functions impacted by CVE-2026-68271?
The functions impacted by CVE-2026-68271 are nouveau_uvmm_vm_bind_ucopy() and nouveau_exec_ucopy().
When was CVE-2026-68271 published?
CVE-2026-68271 was published on August 10, 2026.