UBUNTU-CVE-2026-89800: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: clear the dirty flag when unwinding an OPUNMAPSPARSE A successful OPUNMAPSPARSE marks its region dirty with nouveauuvmaregiondirty() and defers the teardown to nouveauuvmmbindjobcleanup(); it does not remove the region from uvmm->regionmt. If a later op in the job fails, the unwind path never clears reg->dirty (set in one place, cleared nowhere) and sets op->reg = NULL, so cleanup skips the teardown. The region is left in the tree with dirty set and its completion never signalled. Later binds over that range then fail permanently -- -ENOENT or -EINVAL from the dirty checks, or an unkillable waitforcompletion() in bindvalidateregion() -- for the lifetime of the uvmm. Clear reg->dirty when the unwind reverts the sparse unmap, restoring the region to the state it was found in.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Clear reg->dirty in the unwind path when reverting an OP_UNMAP_SPARSE operation, restoring the region to the state it was found in.
Linux kernel drm/nouveau/uvmm reg->dirty = false
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Nouveau DRM UVMM path are affected when a job successfully performs an OP_UNMAP_SPARSE operation and a later operation in that same job fails. Subsequent binds over the affected region can then remain broken for the lifetime of that UVMM.
What does an attacker or triggering workload need to do?
The triggering sequence requires a successful sparse unmap followed by a failure in a later operation in the same bind job. The failed job unwind leaves the region marked dirty and skips its teardown.
How can I tell whether an instance has encountered the problem?
Later binds over a previously sparse-unmapped range may fail with -ENOENT or -EINVAL from dirty-region checks. A bind may also hang indefinitely in wait_for_completion() during bind_validate_region().