CVE-2026-89803

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the drm/nouveau component where the nouveau channel del() function destroys the fence context before unsubscribing from the channel-kill event. This creates a race condition where a kill event can trigger the nouveau channel killed() handler, which subsequently calls nouveau channel kill() and nouveau fence context kill() on the chan->fence object. If this occurs after context del() has already freed the fence context, the system attempts to acquire fctx->lock and traverse fctx->pending on freed memory. This issue specifically affects Fermi architecture and newer versions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.