UBUNTU-CVE-2026-89801: Use After Free

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix premature region free on failed OPUNMAPSPARSE In nouveauuvmmbindjobsubmit()'s OPUNMAPSPARSE arm, op->reg is set from nouveauuvmaregionfind(), which only looks the region up and takes no reference; a region's sole reference is its membership in uvmm->regionmt. Two failure paths leave op->reg set: the -ENOENT check when the region is busy, and the drmgpuvmsmunmapopscreate() failure. The sibling nouveauuvmmsmunmapprepare() failure just below clears op->reg; these two do not. unwindcontinue steps back one op, so the failing op is skipped by the unwind loop and its op->reg stays set. nouveauuvmmbindjobcleanup() then enters its if (op->reg) branch and calls nouveauuvmaregionremove() and nouveauuvmaregionput() on it, dropping the tree's sole reference and freeing a region this job never created. The comment above the cleanup loop documents the broken invariant: op->reg must be NULL on submit failure. This frees a live region on an unrelated failure, reachable single-job when drmgpuvmsmunmapopscreate() returns -ENOMEM; if another job owns the same region, its cleanup then removes and puts the freed region, a use-after-free. Clear op->reg on both failure paths.