CVE-2026-89553: nouveau/gem: reserve the bo in the info ioctl around the vma lookup
Published Sep 11, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
nouveau/gem: reserve the bo in the info ioctl around the vma lookup
In the non-uvmm path, there could be a race between the info lookup finding the vma, and the gem close path closing the vma leading to a use-after-free.
Spotted with the help of Opus 4.6.
Event History
Sep 11, 2026
CVE Published
via MITRE·07:44 PM
Data Sourced
via MITRE·07:44 PM
Description
Frequently Asked Questions
1
Which systems should be prioritized for review?
Systems using the Nouveau GEM non-UVMM path are implicated. The issue concerns VMA handling during the GEM info ioctl in that path.
2
What condition triggers the use-after-free?
The race occurs when an info ioctl locates a VMA while the GEM close path concurrently closes that VMA. Without reservation around the lookup, the ioctl can use the VMA after it has been freed.