CVE-2026-89801

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the drm/nouveau/uvmm component. In the OP UNMAP SPARSE arm of the nouveau uvmm bind job submit() function, the op->reg variable is assigned a value from nouveau uvma region find(). If a failure occurs during the -ENOENT check (when the region is busy) or during the drm gpuvm sm unmap ops create() function, op->reg remains set. During the subsequent cleanup process in nouveau uvmm bind job cleanup(), the system calls nouveau uvma region remove() and nouveau uvma region put(), which prematurely frees a live region. If another job owns the same region, its cleanup process will attempt to access the already freed region, leading to a use-after-free condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.