CVE-2026-89802: drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op
In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau/uvmm: fix NULL deref unwinding an OPMAPSPARSE op
Each bindjobop is zeroed by kzallocobj() in bindjobopfromuop(), and the OPMAPSPARSE case in nouveauuvmmbindjobsubmit() only creates a region, so op->ops stays NULL for a successfully processed sparse map.
If a later op in the same job fails, the reverse unwind loop revisits that op and calls drmgpuvaopsfree(&uvmm->base, op->ops) unconditionally. drmgpuvaopsfree() dereferences its argument right away (listforeachentrysafe on &ops->list), so a NULL op->ops oopses. The path is reachable by any render-node fd holder, since NOUVEAUVMBIND is DRMRENDERALLOW.
Guard the free with ISERRORNULL(), as nouveauuvmmbindjobcleanup() already does for the identical free.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate exposure by restricting access to the affected render-node functionality (vulnerability is reachable by any render-node fd holder, since NOUVEAU_VM_BIND is enabled/available to render-node fd holders).
Event History
Frequently Asked Questions
Who can trigger this issue?
Any holder of a DRM render-node file descriptor can reach the vulnerable path, because NOUVEAU_VM_BIND is permitted on render nodes. This makes exposure relevant where untrusted local users or workloads can access the Nouveau render device.
What is required for exploitation?
An attacker needs to submit a VM bind job containing a successfully processed sparse mapping operation followed by a later operation that fails. During reverse unwinding, the kernel dereferences a NULL operation pointer.
What is the likely impact?
The described result is a kernel oops caused by a NULL-pointer dereference. The provided information supports denial-of-service risk through a crashing kernel path, but does not establish privilege escalation or information disclosure.
What can be done before an update is available?
Restrict access to Nouveau DRM render-node devices for untrusted users and workloads. The vulnerable ioctl is reachable through render-node access.