CVE-2026-89801: drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE
drm/nouveau/uvmm: fix premature region free on failed OPUNMAPSPARSE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Clear op->reg on both OP_UNMAP_SPARSE submit-failure paths: the -ENOENT busy-region check and drm_gpuvm_sm_unmap_ops_create() failure, preserving the invariant that op->reg is NULL on submit failure.
Linux kernel drm/nouveau/uvmm op->reg = NULL
Event History
Frequently Asked Questions
What conditions are required to trigger the faulty cleanup?
A failed OP_UNMAP_SPARSE submission must leave a region pointer set. The described paths are a busy-region -ENOENT result and failure of drm_gpuvm_sm_unmap_ops_create(); the latter is reachable by a single job when it returns -ENOMEM.
What is the impact of the failed operation?
Cleanup can remove and release a live UVMM region that the failed job did not create. Because the region's only reference is its membership in the region tree, this can free the region while another job may still own or use it, resulting in a use-after-free.
Can affected systems be identified by kernel version from this information?
No affected or fixed kernel version ranges are provided. The supplied stable-kernel references should be used to determine whether the relevant fixes are present in a specific kernel tree.