CVE-2026-43381: Linux Kernel Nouveau DPCD DoS Vulnerability

CVE-2026-43381 Overview

CVE-2026-43381 affects the Linux kernel's nouveau graphics driver, specifically the DisplayPort Configuration Data (DPCD) auxiliary transfer path. When a GPU is runtime-suspended and userspace attempts to access /dev/drm_dp_* interfaces, the driver crashes inside the GPU System Processor (GSP) code instead of returning a controlled error. The fix returns -EBUSY to userspace when the device is asleep, preventing the kernel warning in r535_gsp_msgq_wait. Affected systems run NVIDIA GPUs managed by the nouveau driver on kernels prior to the patched stable releases.

Critical Impact
Local userspace processes such as fwupd can trigger a kernel warning and unstable GPU state by issuing DPCD auxiliary transfers while the device is runtime-suspended.

Affected Products

Linux kernel nouveau driver (DPCD/AUX subsystem)
NVIDIA GPUs using the GSP firmware path under nouveau (e.g., Turing and newer)
Distributions shipping kernel 6.18.10 and earlier stable branches prior to the backport

Discovery Timeline

2026-05-08 - CVE-2026-43381 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-43381

Vulnerability Analysis

The defect lives in the nouveau DisplayPort auxiliary channel handler. When userspace opens /dev/drm_dp_aux* and issues a transfer, the driver forwards the request to the GSP via RPC. If the GPU is runtime power management (RPM) suspended, the message queue is not initialized, and r535_gsp_msgq_wait in drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c triggers a WARN at line 164.

The upstream patch short-circuits the path: if the device is asleep, the aux transfer function returns -EBUSY to userspace rather than entering the GSP RPC path. The commit notes a proper fix would involve a power-domain solution that wakes the device and keeps it awake during firmware updates, but the current change is a minimal, backportable mitigation.

Root Cause

The driver lacks a runtime-PM state check before dispatching DPCD aux transfers through the GSP message queue. Calling into GSP RPC infrastructure while the device is suspended produces an invalid state and a kernel warning, exposing a robustness gap rather than a memory-safety primitive.

Attack Vector

The trigger is local. Any process with access to /dev/drm_dp_aux* (typically root or a privileged service like fwupd) can hit the path while the GPU is runtime-suspended. The reproducer in the commit message is a routine firmware update workflow, not a crafted exploit.

No public proof-of-concept exploit is required because legitimate firmware-update activity reproduces the warning. See the upstream stable commits for technical details: Linux kernel patch 178df7c9 and Linux kernel patch fad178ae.

Detection Methods for CVE-2026-43381

Indicators of Compromise

Kernel log entries containing WARNING: ... r535_gsp_msgq_wait+0x9a/0xb0 [nouveau]
dmesg traces referencing drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c:164
Process context showing fwupd or similar firmware tools issuing DRM DP aux ioctls during GPU runtime suspend

Detection Strategies

Monitor /var/log/kern.log or the systemd journal for nouveau warnings tied to GSP RPC paths.
Correlate DRM aux character device access (/dev/drm_dp_aux*) with GPU runtime power-management state transitions.
Track repeated kernel WARN_ON taints on hosts using nouveau with NVIDIA GSP-class GPUs.

Monitoring Recommendations

Forward kernel ring buffer events to a centralized log pipeline and alert on nouveau plus r535_gsp_msgq_wait patterns.
Inventory hosts running affected kernel versions with NVIDIA GPUs bound to nouveau, prioritizing laptops and workstations using fwupd.
Audit which local users and services have access to DRM DP aux device nodes.

How to Mitigate CVE-2026-43381

Immediate Actions Required

Apply the stable kernel update containing the nouveau DPCD -EBUSY fix from your distribution.
Defer GPU firmware updates via fwupd until the patched kernel is installed and active.
Restrict access to /dev/drm_dp_aux* device nodes to required administrative tooling only.

Patch Information

The fix is distributed across the stable trees as backports. Reference commits include 178df7c9, 24639553, 4df518aa, 6bdd2d70, 8f3c6f08, ad8fa5bf, cd24cab2, and fad178ae. Install vendor kernel packages once they ship these backports.

Workarounds

Disable nouveau runtime power management for the affected GPU by booting with nouveau.runpm=0 to keep the device awake.
Blacklist nouveau and use an alternative driver where operationally acceptable until patches land.
Prevent firmware update tools from running on hosts with affected kernels until remediation is complete.

bash

# Verify kernel version and check for the nouveau warning
uname -r
dmesg | grep -iE 'nouveau|r535_gsp_msgq_wait'

# Temporary mitigation: disable nouveau runtime power management
# Add to /etc/default/grub GRUB_CMDLINE_LINUX, then regenerate config
GRUB_CMDLINE_LINUX="... nouveau.runpm=0"
sudo grub2-mkconfig -o /boot/grub2/grub.cfg