CVE-2026-98512: drm/nouveau: RCU-free the scheduler-containing nouveau_sched
In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau: RCU-free the scheduler-containing nouveausched
struct nouveausched embeds a struct drmgpuscheduler (base). nouveauscheddestroy() calls nouveauschedfini() (which does drmschedfini(&sched->base)) and then frees the object with plain kfree(sched).
drmschedfencegettimelinename() returns fence->sched->name, and the scheduler fence keeps a .release callback so it is not ops-detached on signalling. A finished fence exported to userspace via drmsyncobj / syncfile therefore keeps pointing at &sched->base after nouveauscheddestroy(), and a later gettimelinename() -- reachable unprivileged through SYNCIOCFILEINFO -- dereferences freed memory (KASAN slab-use-after-free read).
Per the dma-fence lifetime contract the exporter must keep the data backing a signalled fence alive for an RCU grace period. Free the scheduler-containing object with kfreercu() instead of kfree().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.55 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.9
Event History
Frequently Asked Questions
Does triggering this issue require elevated privileges?
No. A later timeline-name lookup is reachable by an unprivileged user through SYNC_IOC_FILE_INFO, but a finished fence must first have been exported to userspace through drm_syncobj or sync_file after the associated scheduler is destroyed.
What change fixes the lifetime issue?
The scheduler-containing nouveau_sched object must be released with kfree_rcu() rather than plain kfree(). This preserves the data backing signalled fences until an RCU grace period has elapsed.