CVE-2026-98512

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: RCU-free the scheduler-containing nouveau sched

struct nouveau sched embeds a struct drm gpu scheduler (base). nouveau sched destroy() calls nouveau sched fini() (which does drm sched fini(&sched->base)) and then frees the object with plain kfree(sched).

drm sched fence get timeline name() returns fence->sched->name, and the scheduler fence keeps a .release callback so it is not ops-detached on signalling. A finished fence exported to userspace via drm syncobj / sync file therefore keeps pointing at &sched->base after nouveau sched destroy(), and a later get timeline name() -- reachable unprivileged through SYNC IOC FILE INFO -- dereferences freed memory (KASAN slab-use-after-free read).

Per the dma-fence lifetime contract the exporter must keep the data backing a signalled fence alive for an RCU grace period. Free the scheduler-containing object with kfree rcu() instead of kfree().