PT-2026-116734 · Linux · Linux
CVE-2026-98515
·
Published
2026-10-18
·
Updated
2026-10-18
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau: fix double-free in nvif vmm dtor
On failure, nouveau cli init() calls nouveau cli fini() to tear
the client down. Then, nouveau drm open() also enters into its
cleanup path and calls nouveau cli fini() AGAIN. nouveau cli fini()
calls nouveau vmm fini():
void
nouveau vmm fini(struct nouveau vmm *vmm)
{
nouveau svmm fini(&vmm->svmm);
nvif vmm dtor(&vmm->vmm);
vmm->cli = NULL;
}Inside nvif vmm dtor(), vmm->page is freed unconditionally:
void
nvif vmm dtor(struct nvif vmm *vmm)
{
kfree(vmm->page);
nvif object dtor(&vmm->object);
}vmm->page is never cleared after being freed, so the second call of
nvif vmm dtor() will cause a double-free.
Found by fuzzing the nouveau driver with a modified Syzkaller:
BUG: KASAN: double-free in nvif vmm dtor+0x31/0x50 drivers/gpu/drm/nouveau/nvif/vmm.c:194
Free of addr ffff888010fcdc30 by task syz.0.173/2567
CPU: 1 UID: 0 PID: 2567 Comm: syz.0.173 Not tainted 7.2.0 #24 PREEMPT(lazy)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump stack lib/dump stack.c:94 [inline]
dump stack lvl+0x95/0xe0 lib/dump stack.c:120
print address description mm/kasan/report.c:378 [inline]
print report+0xcb/0x5a0 mm/kasan/report.c:482
kasan report invalid free+0xaa/0xd0 mm/kasan/report.c:557
check slab allocation+0xe4/0x110 mm/kasan/common.c:235
kasan slab pre free include/linux/kasan.h:199 [inline]
slab free hook mm/slub.c:2622 [inline]
slab free mm/slub.c:6377 [inline]
kfree+0x192/0x590 mm/slub.c:6692
nvif vmm dtor+0x31/0x50 drivers/gpu/drm/nouveau/nvif/vmm.c:194
nouveau vmm fini+0x16/0x50 drivers/gpu/drm/nouveau/nouveau vmm.c:127
nouveau cli fini+0x10e/0x210 drivers/gpu/drm/nouveau/nouveau drm.c:225
nouveau drm open+0x24e/0x740 drivers/gpu/drm/nouveau/nouveau drm.c:1255
drm file alloc+0x5f2/0xad0 drivers/gpu/drm/drm file.c:176
drm open helper+0x1d7/0x4a0 drivers/gpu/drm/drm file.c:335
drm open+0x190/0x3d0 drivers/gpu/drm/drm file.c:388
drm stub open+0x1f2/0x460 drivers/gpu/drm/drm drv.c:1211
chrdev open+0x21c/0x660 fs/char dev.c:411
do dentry open+0x59d/0x12b0 fs/open.c:947
vfs open+0x82/0x390 fs/open.c:1052
do open fs/namei.c:4700 [inline]
path openat+0x2345/0x3420 fs/namei.c:4863
do file open+0x207/0x460 fs/namei.c:4892
do sys openat2+0xd1/0x1d0 fs/open.c:1368
do sys open fs/open.c:1374 [inline]
do sys openat fs/open.c:1390 [inline]
se sys openat fs/open.c:1385 [inline]
x64 sys openat+0x144/0x200 fs/open.c:1385
do syscall x64 arch/x86/entry/syscall 64.c:63 [inline]
do syscall 64+0x115/0x690 arch/x86/entry/syscall 64.c:94
entry SYSCALL 64 after hwframe+0x77/0x7f
RIP: 0033:0x7fc6d687594d
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc6d5295008 EFLAGS: 00000246 ORIG RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fc6d6b06180 RCX: 00007fc6d687594d
RDX: 0000000000022501 RSI: 0000200000000000 RDI: ffffffffffffff9c
RBP: 00007fc6d691c303 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc6d6b06218 R14: 00007fc6d6b06180 R15: 00007ffd9451d760
</TASK>
Allocated by task 2567 on cpu 1 at 163.593900s:
kasan save stack+0x24/0x50 mm/kasan/common.c:57
kasan save track+0x17/0x60 mm/kasan/common.c:78
poison kmalloc redzone mm/kasan/common.c:398 [inline]
kasan kmalloc+0xaa/0xb0 mm/kasan/common.c:415
kasan kmalloc include/linux/kasan.h:263 [inline]
do kmalloc node mm/slub.c:5334 [inline]
kmalloc noprof+0x304/0x7c0 mm/slub.c:5359
kmalloc noprof include/linux/slab.h:992 [inline]
nvif vmm ctor+0x3c0/0x7e0 drivers/gpu/drm/nouveau/nvif/vmm.c:237
nouveau vmm init+0x40/0x90 drivers/gpu/drm/nouveau/nouveau vmm.c:134
nouveau cli init+0x7b9/0---truncated---
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux