CVE-2026-89553

A use-after-free exists in the Linux kernel's nouveau DRM driver, in the non-uvmm path of the GEM info ioctl. A race window between the ioctl's vma lookup and the GEM close path freeing that vma allows a local, unprivileged attacker with access to the GPU device to trigger kernel memory corruption, potentially leading to privilege escalation or a system crash (CVSS 3.1: 7.8, with high confidentiality, integrity, and availability impact). Systems affected are those running kernel builds that include the in-tree nouveau open-source driver with NVIDIA GPUs, when unprivileged users can open the DRM render node. The flaw was fixed by reserving the buffer object around the vma lookup, and was reportedly found with the assistance of automated analysis tooling. No public proof of concept exists and there is no indication of exploitation in the wild.

What to do: Apply your distribution's kernel update once the fix for this issue is shipped, and reboot to load the patched kernel. As an interim mitigation, restrict local unprivileged access to the nouveau DRM render nodes (e.g., udev rules or group permissions on /dev/dri/*) or switch affected systems to NVIDIA's proprietary driver stack, which does not use nouveau. Check whether hosts have untrusted local users or container workloads with GPU device access, as those are the realistic attack paths for this local-only flaw.