{"api_version":"1","generated_at":"2026-09-17T10:34:22+00:00","cve":"CVE-2026-89801","urls":{"html":"https://cve.report/CVE-2026-89801","api":"https://cve.report/api/cve/CVE-2026-89801.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-89801","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-89801"},"summary":{"title":"drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE\n\nIn nouveau_uvmm_bind_job_submit()'s OP_UNMAP_SPARSE arm, op->reg is set\nfrom nouveau_uvma_region_find(), which only looks the region up and takes\nno reference; a region's sole reference is its membership in\nuvmm->region_mt. Two failure paths leave op->reg set: the -ENOENT check\nwhen the region is busy, and the drm_gpuvm_sm_unmap_ops_create() failure.\nThe sibling nouveau_uvmm_sm_unmap_prepare() failure just below clears\nop->reg; these two do not.\n\nunwind_continue steps back one op, so the failing op is skipped by the\nunwind loop and its op->reg stays set. nouveau_uvmm_bind_job_cleanup()\nthen enters its if (op->reg) branch and calls nouveau_uvma_region_remove()\nand nouveau_uvma_region_put() on it, dropping the tree's sole reference\nand freeing a region this job never created. The comment above the\ncleanup loop documents the broken invariant: op->reg must be NULL on\nsubmit failure.\n\nThis frees a live region on an unrelated failure, reachable single-job\nwhen drm_gpuvm_sm_unmap_ops_create() returns -ENOMEM; if another job owns\nthe same region, its cleanup then removes and puts the freed region, a\nuse-after-free. Clear op->reg on both failure paths.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-16 11:16:44","updated_at":"2026-09-16 15:18:09"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/88114e3a96582882e63b2f73aa7a5a9cf0d5073c","name":"https://git.kernel.org/stable/c/88114e3a96582882e63b2f73aa7a5a9cf0d5073c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/24c25b182d17d1bdfde0088c96bdf6f93e8f46bc","name":"https://git.kernel.org/stable/c/24c25b182d17d1bdfde0088c96bdf6f93e8f46bc","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/4083d24c2636fde7b18076115af52820d203bc57","name":"https://git.kernel.org/stable/c/4083d24c2636fde7b18076115af52820d203bc57","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ba42d8a1c2c7629c61914df11a7d63ac77449ffb","name":"https://git.kernel.org/stable/c/ba42d8a1c2c7629c61914df11a7d63ac77449ffb","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ccf930812f23b8259ef64fd3394d53b093e4651a","name":"https://git.kernel.org/stable/c/ccf930812f23b8259ef64fd3394d53b093e4651a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89801","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89801","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b88baab828713ce0b49b185444b2ee83bed373a8 ba42d8a1c2c7629c61914df11a7d63ac77449ffb git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b88baab828713ce0b49b185444b2ee83bed373a8 88114e3a96582882e63b2f73aa7a5a9cf0d5073c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b88baab828713ce0b49b185444b2ee83bed373a8 24c25b182d17d1bdfde0088c96bdf6f93e8f46bc git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b88baab828713ce0b49b185444b2ee83bed373a8 4083d24c2636fde7b18076115af52820d203bc57 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b88baab828713ce0b49b185444b2ee83bed373a8 ccf930812f23b8259ef64fd3394d53b093e4651a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.6","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.157 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.110 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.51 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.5 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/nouveau/nouveau_uvmm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ba42d8a1c2c7629c61914df11a7d63ac77449ffb","status":"affected","version":"b88baab828713ce0b49b185444b2ee83bed373a8","versionType":"git"},{"lessThan":"88114e3a96582882e63b2f73aa7a5a9cf0d5073c","status":"affected","version":"b88baab828713ce0b49b185444b2ee83bed373a8","versionType":"git"},{"lessThan":"24c25b182d17d1bdfde0088c96bdf6f93e8f46bc","status":"affected","version":"b88baab828713ce0b49b185444b2ee83bed373a8","versionType":"git"},{"lessThan":"4083d24c2636fde7b18076115af52820d203bc57","status":"affected","version":"b88baab828713ce0b49b185444b2ee83bed373a8","versionType":"git"},{"lessThan":"ccf930812f23b8259ef64fd3394d53b093e4651a","status":"affected","version":"b88baab828713ce0b49b185444b2ee83bed373a8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/nouveau/nouveau_uvmm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.6"},{"lessThan":"6.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.157","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.110","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.51","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.157","versionStartIncluding":"6.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.110","versionStartIncluding":"6.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.51","versionStartIncluding":"6.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.5","versionStartIncluding":"6.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc2","versionStartIncluding":"6.6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE\n\nIn nouveau_uvmm_bind_job_submit()'s OP_UNMAP_SPARSE arm, op->reg is set\nfrom nouveau_uvma_region_find(), which only looks the region up and takes\nno reference; a region's sole reference is its membership in\nuvmm->region_mt. Two failure paths leave op->reg set: the -ENOENT check\nwhen the region is busy, and the drm_gpuvm_sm_unmap_ops_create() failure.\nThe sibling nouveau_uvmm_sm_unmap_prepare() failure just below clears\nop->reg; these two do not.\n\nunwind_continue steps back one op, so the failing op is skipped by the\nunwind loop and its op->reg stays set. nouveau_uvmm_bind_job_cleanup()\nthen enters its if (op->reg) branch and calls nouveau_uvma_region_remove()\nand nouveau_uvma_region_put() on it, dropping the tree's sole reference\nand freeing a region this job never created. The comment above the\ncleanup loop documents the broken invariant: op->reg must be NULL on\nsubmit failure.\n\nThis frees a live region on an unrelated failure, reachable single-job\nwhen drm_gpuvm_sm_unmap_ops_create() returns -ENOMEM; if another job owns\nthe same region, its cleanup then removes and puts the freed region, a\nuse-after-free. Clear op->reg on both failure paths."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through DRM_IOCTL_NOUVEAU_VM_BIND on a nouveau render node (/dev/dri/renderD*): nouveau_uvmm_ioctl_vm_bind → nouveau_job_submit → nouveau_uvmm_bind_job_submit. This is a local ioctl path, not a network, adjacent-radio, or physical-bus interface.\nAC:L - An attacker can MAP_SPARSE a region, submit an async OP_UNMAP_SPARSE that dirties it while holding op->reg, then a second OP_UNMAP_SPARSE on the same range (or two unmaps in one ioctl). The failing path leaves op->reg set and cleanup frees the live region. The attacker drives both jobs, so no condition is outside their control.\nPR:L - NOUVEAU_VM_INIT and NOUVEAU_VM_BIND are DRM_RENDER_ALLOW with no DRM_ROOT_ONLY or capability checks. Any unprivileged local user who can open the nouveau render node (typical render/video group) can trigger this without init-namespace root.\nUI:N - The attacker opens their own DRM client and issues VM_INIT/VM_BIND ioctls on that fd; no separate victim action such as mounting a filesystem or opening an attacker-controlled file is required.\nS:U - The use-after-free corrupts kernel heap state (struct nouveau_uvma_region) inside the host nouveau driver. Impact stays in the same kernel authority; this is not a VM escape or IOMMU/DMA isolation bypass.\nC:H - Cleanup of a failed OP_UNMAP_SPARSE drops the maple-tree's sole reference and kfree()s a live nouveau_uvma_region another job still holds in op->reg. That use-after-free of a kernel object enables disclosure of reused slab contents, so confidentiality is High.\nI:H - The owning job's later cleanup calls sparse-unref, mas_erase, complete_all, and kref_put on the already-freed region. Heap spraying can reuse that object to corrupt kernel pointers and hijack control flow, so integrity is High.\nA:H - Dereferencing the freed nouveau_uvma_region in nouveau_uvmm_bind_job_cleanup, maple-tree remove, or a later bind causes a kernel oops/panic; the attacker can repeat the sequence to crash or hang the system."}]}],"providerMetadata":{"dateUpdated":"2026-09-16T14:38:47.092Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/ba42d8a1c2c7629c61914df11a7d63ac77449ffb"},{"url":"https://git.kernel.org/stable/c/88114e3a96582882e63b2f73aa7a5a9cf0d5073c"},{"url":"https://git.kernel.org/stable/c/24c25b182d17d1bdfde0088c96bdf6f93e8f46bc"},{"url":"https://git.kernel.org/stable/c/4083d24c2636fde7b18076115af52820d203bc57"},{"url":"https://git.kernel.org/stable/c/ccf930812f23b8259ef64fd3394d53b093e4651a"}],"title":"drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-89801","datePublished":"2026-09-16T10:30:34.458Z","dateReserved":"2026-09-11T19:38:34.767Z","dateUpdated":"2026-09-16T14:38:47.092Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-16 11:16:44","lastModifiedDate":"2026-09-16 15:18:09","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"89801","Ordinal":"1","Title":"drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_S","CVE":"CVE-2026-89801","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"89801","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE\n\nIn nouveau_uvmm_bind_job_submit()'s OP_UNMAP_SPARSE arm, op->reg is set\nfrom nouveau_uvma_region_find(), which only looks the region up and takes\nno reference; a region's sole reference is its membership in\nuvmm->region_mt. Two failure paths leave op->reg set: the -ENOENT check\nwhen the region is busy, and the drm_gpuvm_sm_unmap_ops_create() failure.\nThe sibling nouveau_uvmm_sm_unmap_prepare() failure just below clears\nop->reg; these two do not.\n\nunwind_continue steps back one op, so the failing op is skipped by the\nunwind loop and its op->reg stays set. nouveau_uvmm_bind_job_cleanup()\nthen enters its if (op->reg) branch and calls nouveau_uvma_region_remove()\nand nouveau_uvma_region_put() on it, dropping the tree's sole reference\nand freeing a region this job never created. The comment above the\ncleanup loop documents the broken invariant: op->reg must be NULL on\nsubmit failure.\n\nThis frees a live region on an unrelated failure, reachable single-job\nwhen drm_gpuvm_sm_unmap_ops_create() returns -ENOMEM; if another job owns\nthe same region, its cleanup then removes and puts the freed region, a\nuse-after-free. Clear op->reg on both failure paths.","Type":"Description","Title":"drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_S"}]}}}