CVE-2026-98517: drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau/uvmm: fix UAF in nouveauuvmmsm when BO is in TTMPLSYSTEM
nouveauuvmmsm() calls opmap(), which passes bo->resource through nouveaumem() to nouveauuvmamap(). nouveauuvmmvmmmap() then reads mem->mem.type.
But this is only valid when bo->resource is backed by struct nouveaumem, as is the case for VRAM and TT resources. If the BO is left in TTMPLSYSTEM, bo->resource is only a struct ttmresource. Treating it as struct nouveaumem makes the mem->mem.type read past the end of the resource, causing a KASAN: slab-use-after-free Read in nouveauuvmmsm report:
BUG: KASAN: slab-use-after-free in nouveauuvmmvmmmap drivers/gpu/drm/nouveau/nouveauuvmm.c:152 [inline] BUG: KASAN: slab-use-after-free in nouveauuvmamap drivers/gpu/drm/nouveau/nouveauuvmm.c:199 [inline] BUG: KASAN: slab-use-after-free in opmap drivers/gpu/drm/nouveau/nouveauuvmm.c:849 [inline] BUG: KASAN: slab-use-after-free in nouveauuvmmsm.constprop.0+0x6ab/0x900 drivers/gpu/drm/nouveau/nouveauuvmm.c:903 Read of size 1 at addr ffff888127d3e3a0 by task kworker/0:1/11
CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 7.2.0 #5 PREEMPT(lazy) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: nouveauschedwq2224 drmschedrunjobwork Call Trace: <TASK> dumpstack lib/dumpstack.c:94 [inline] dumpstacklvl+0x95/0xe0 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:378 [inline] printreport+0xcb/0x5a0 mm/kasan/report.c:482 kasanreport+0xca/0x100 mm/kasan/report.c:595 nouveauuvmmvmmmap drivers/gpu/drm/nouveau/nouveauuvmm.c:152 [inline] nouveauuvmamap drivers/gpu/drm/nouveau/nouveauuvmm.c:199 [inline] opmap drivers/gpu/drm/nouveau/nouveauuvmm.c:849 [inline] nouveauuvmmsm.constprop.0+0x6ab/0x900 drivers/gpu/drm/nouveau/nouveauuvmm.c:903 nouveauuvmmsmunmap drivers/gpu/drm/nouveau/nouveauuvmm.c:932 [inline] nouveauuvmmbindjobrun+0xd6/0x250 drivers/gpu/drm/nouveau/nouveauuvmm.c:1532 nouveaujobrun drivers/gpu/drm/nouveau/nouveausched.c:350 [inline] nouveauschedrunjob+0x62/0xd0 drivers/gpu/drm/nouveau/nouveausched.c:364 drmschedrunjobwork+0x356/0xa10 drivers/gpu/drm/scheduler/schedmain.c:1061 processonework+0x8a5/0x1900 kernel/workqueue.c:3322 processscheduledworks kernel/workqueue.c:3405 [inline] workerthread+0x5dd/0xd80 kernel/workqueue.c:3486 kthread+0x31d/0x420 kernel/kthread.c:436 retfromfork+0x662/0x940 arch/x86/kernel/process.c:158 retfromforkasm+0x1a/0x30 arch/x86/entry/entry64.S:245 </TASK>
Allocated by task 2224 on cpu 0 at 66.550027s: kasansavestack+0x24/0x50 mm/kasan/common.c:57 kasansavetrack+0x17/0x60 mm/kasan/common.c:78 poisonkmallocredzone mm/kasan/common.c:398 [inline] kasankmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasankmalloc include/linux/kasan.h:263 [inline] dokmallocnode mm/slub.c:5334 [inline] kmallocnoprof+0x304/0x7c0 mm/slub.c:5359 kmallocnoprof include/linux/slab.h:992 [inline] dmaresvlistalloc+0x27/0x90 drivers/dma-buf/dma-resv.c:106 dmaresvreservefences+0x60e/0xa30 drivers/dma-buf/dma-resv.c:205 ttmboallocresource+0x12c/0xbd0 drivers/gpu/drm/ttm/ttmbo.c:721 ttmbovalidate+0x1bc/0x4a0 drivers/gpu/drm/ttm/ttmbo.c:856 ttmboinitreserved+0x2c3/0x570 drivers/gpu/drm/ttm/ttmbo.c:970 nouveauboinit+0x159/0x2c0 drivers/gpu/drm/nouveau/nouveaubo.c:359 nouveaugemnew+0x234/0x5f0 drivers/gpu/drm/nouveau/nouveaugem.c:272 nouveaugemioctlnew+0x1eb/0x420 drivers/gpu/drm/nouveau/nouveaugem.c:352 drmioctlkernel+0x192/0x350 drivers/gpu/drm/drmioctl.c:817 drmioctl+0x4f8/0xb40 drivers/gpu/drm/drmioctl.c:914 nouveaudrmioctl+0xea/0x2c0 drivers/gpu/drm/nouveau/nouveaudrm.c:1338 vfsioctl fs/ioctl.c:51 [inline] dosysioctl fs/ioctl.c:597 [inline] sesysioctl fs/ioctl.c:583 [inline] x64sysioctl+0x180/0x1d0 fs/ioctl.c:583 dosyscallx64 ar ---truncated---