CVE-2026-93233

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the drm/nouveau/dmem component where a callocated underflow occurs during a large folio split. The nouveau dmem folio free() function decrements the chunk->callocated counter once per freed folio, but large device-private folios are only counted once upon allocation. When the memory management core invokes nouveau dmem folio split() for each new sub-folio, the chunk->callocated value remains unchanged. Consequently, when these sub-folios are freed separately, the counter underflows, causing the unsigned counter to wrap. This prevents the chunk from being reclaimed and triggers warnings in nouveau dmem fini().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.