CVE-2026-89553 — nouveau/gem: reserve the bo in the info ioctl around the vma lookup
In the Linux kernel, the following vulnerability has been resolved: nouveau/gem: reserve the bo in the info ioctl around the vma lookup In the non-uvmm path, there could be a …
Published: 2026-09-11 · CVSS: 7.8 · CVSS 3.1
In the Linux kernel, the following vulnerability has been resolved: nouveau/gem: reserve the bo in the info ioctl around the vma lookup In the non-uvmm path, there could be a race between the info lookup finding the vma, and the gem close path closing the vma leading to a use-after-free. Spotted with the help of Opus 4.6.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7