CVE-2026-98517

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau/uvmm: fix UAF in nouveau uvmm sm when BO is in TTM PL SYSTEM

nouveau uvmm sm() calls op map(), which passes bo->resource through nouveau mem() to nouveau uvma map(). nouveau uvmm vmm map() then reads mem->mem.type.

But this is only valid when bo->resource is backed by struct nouveau mem, as is the case for VRAM and TT resources. If the BO is left in TTM PL SYSTEM, bo->resource is only a struct ttm resource. Treating it as struct nouveau mem makes the mem->mem.type read past the end of the resource, causing a KASAN: slab-use-after-free Read in nouveau uvmm sm report:

BUG: KASAN: slab-use-after-free in nouveau uvmm vmm map drivers/gpu/drm/nouveau/nouveau uvmm.c:152 [inline] BUG: KASAN: slab-use-after-free in nouveau uvma map drivers/gpu/drm/nouveau/nouveau uvmm.c:199 [inline] BUG: KASAN: slab-use-after-free in op map drivers/gpu/drm/nouveau/nouveau uvmm.c:849 [inline] BUG: KASAN: slab-use-after-free in nouveau uvmm sm.constprop.0+0x6ab/0x900 drivers/gpu/drm/nouveau/nouveau uvmm.c:903 Read of size 1 at addr ffff888127d3e3a0 by task kworker/0:1/11

CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 7.2.0 #5 PREEMPT(lazy) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: nouveau sched wq 2224 drm sched run job work Call Trace: dump stack lib/dump stack.c:94 [inline] dump stack lvl+0x95/0xe0 lib/dump stack.c:120 print address description mm/kasan/report.c:378 [inline] print report+0xcb/0x5a0 mm/kasan/report.c:482 kasan report+0xca/0x100 mm/kasan/report.c:595 nouveau uvmm vmm map drivers/gpu/drm/nouveau/nouveau uvmm.c:152 [inline] nouveau uvma map drivers/gpu/drm/nouveau/nouveau uvmm.c:199 [inline] op map drivers/gpu/drm/nouveau/nouveau uvmm.c:849 [inline] nouveau uvmm sm.constprop.0+0x6ab/0x900 drivers/gpu/drm/nouveau/nouveau uvmm.c:903 nouveau uvmm sm unmap drivers/gpu/drm/nouveau/nouveau uvmm.c:932 [inline] nouveau uvmm bind job run+0xd6/0x250 drivers/gpu/drm/nouveau/nouveau uvmm.c:1532 nouveau job run drivers/gpu/drm/nouveau/nouveau sched.c:350 [inline] nouveau sched run job+0x62/0xd0 drivers/gpu/drm/nouveau/nouveau sched.c:364 drm sched run job work+0x356/0xa10 drivers/gpu/drm/scheduler/sched main.c:1061 process one work+0x8a5/0x1900 kernel/workqueue.c:3322 process scheduled works kernel/workqueue.c:3405 [inline] worker thread+0x5dd/0xd80 kernel/workqueue.c:3486 kthread+0x31d/0x420 kernel/kthread.c:436 ret from fork+0x662/0x940 arch/x86/kernel/process.c:158 ret from fork asm+0x1a/0x30 arch/x86/entry/entry 64.S:245

Allocated by task 2224 on cpu 0 at 66.550027s: kasan save stack+0x24/0x50 mm/kasan/common.c:57 kasan save track+0x17/0x60 mm/kasan/common.c:78 poison kmalloc redzone mm/kasan/common.c:398 [inline] kasan kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan kmalloc include/linux/kasan.h:263 [inline] do kmalloc node mm/slub.c:5334 [inline] kmalloc noprof+0x304/0x7c0 mm/slub.c:5359 kmalloc noprof include/linux/slab.h:992 [inline] dma resv list alloc+0x27/0x90 drivers/dma-buf/dma-resv.c:106 dma resv reserve fences+0x60e/0xa30 drivers/dma-buf/dma-resv.c:205 ttm bo alloc resource+0x12c/0xbd0 drivers/gpu/drm/ttm/ttm bo.c:721 ttm bo validate+0x1bc/0x4a0 drivers/gpu/drm/ttm/ttm bo.c:856 ttm bo init reserved+0x2c3/0x570 drivers/gpu/drm/ttm/ttm bo.c:970 nouveau bo init+0x159/0x2c0 drivers/gpu/drm/nouveau/nouveau bo.c:359 nouveau gem new+0x234/0x5f0 drivers/gpu/drm/nouveau/nouveau gem.c:272 nouveau gem ioctl new+0x1eb/0x420 drivers/gpu/drm/nouveau/nouveau gem.c:352 drm ioctl kernel+0x192/0x350 drivers/gpu/drm/drm ioctl.c:817 drm ioctl+0x4f8/0xb40 drivers/gpu/drm/drm ioctl.c:914 nouveau drm ioctl+0xea/0x2c0 drivers/gpu/drm/nouveau/nouveau drm.c:1338 vfs ioctl fs/ioctl.c:51 [inline] do sys ioctl fs/ioctl.c:597 [inline] se sys ioctl fs/ioctl.c:583 [inline] x64 sys ioctl+0x180/0x1d0 fs/ioctl.c:583 do syscall x64 ar ---truncated---