CVE-2026-46006: Linux Kernel Privilege Escalation Flaw

CVE-2026-46006 Overview

CVE-2026-46006 is a Linux kernel vulnerability in the Nouveau Direct Rendering Manager (DRM) driver for NVIDIA graphics hardware. The flaw resides in nouveau_gem_pushbuf_reloc_apply(), which validates each GEM (Graphics Execution Manager) relocation entry submitted from userspace. The bounds check r->reloc_bo_offset + 4 > nvbo->bo.base.size performs 32-bit arithmetic because reloc_bo_offset is declared __u32 in the UAPI. The addition can wrap around before being compared against the size_t buffer object size, allowing a crafted relocation to bypass the bounds check. The kernel maintainers resolved the issue by casting the operands to u64 so the addition occurs in 64-bit arithmetic.

Critical Impact
A local user submitting crafted GPU pushbuffer relocations can defeat the bounds check, enabling out-of-bounds memory access within kernel-managed buffer objects on systems using the Nouveau driver.

Affected Products

Linux kernel versions containing the unpatched nouveau_gem_pushbuf_reloc_apply() function in drivers/gpu/drm/nouveau/
Systems using the Nouveau open-source driver for NVIDIA GPUs
Distributions shipping the affected kernel prior to the upstream fix

Discovery Timeline

2026-05-27 - CVE-2026-46006 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46006

Vulnerability Analysis

The Nouveau driver exposes the DRM_IOCTL_NOUVEAU_GEM_PUSHBUF interface so userspace can submit command buffers and relocation entries to the GPU. Each relocation describes an offset inside a buffer object where the kernel must patch a 32-bit value. Before patching, the kernel verifies the offset lies within the bounds of the target buffer object. The check in nouveau_gem_pushbuf_reloc_apply() evaluates r->reloc_bo_offset + 4 > nvbo->bo.base.size to ensure four bytes are addressable.

Because reloc_bo_offset is a __u32 and the literal 4 is an unsigned int, the addition is computed in 32-bit width. Supplying a reloc_bo_offset value near UINT_MAX causes the sum to wrap to a small number that compares as less than the buffer size. The check passes, and the subsequent write proceeds at the unwrapped offset, producing an out-of-bounds memory access in the GPU buffer object backing memory.

Root Cause

The defect is a numeric truncation and integer overflow [CWE-190] in the kernel-userspace boundary validation logic. The arithmetic type of the addition follows C integer promotion rules, which preserve 32-bit width because both operands are 32-bit unsigned. The upstream fix casts to u64 so the comparison against the size_t buffer size is performed in 64-bit arithmetic, preventing wrap-around.

Attack Vector

Exploitation requires local access and the ability to open the Nouveau DRM device node (typically /dev/dri/card* or /dev/dri/renderD*). An unprivileged user with rendering permissions can issue a DRM_IOCTL_NOUVEAU_GEM_PUSHBUF call that contains a drm_nouveau_gem_pushbuf_reloc entry with reloc_bo_offset set to a value that wraps in 32-bit arithmetic. The attack does not require network access or user interaction beyond submitting the malformed ioctl.

No verified public proof-of-concept code is referenced in the advisory. See the upstream commits for the precise patch diff: Kernel Git Commit 2fc87d3, Kernel Git Commit 332884f5, and Kernel Git Commit fa297e9.

Detection Methods for CVE-2026-46006

Indicators of Compromise

Unexpected GPU memory corruption, rendering artifacts, or Nouveau driver oops messages in dmesg referencing nouveau_gem_pushbuf_reloc_apply
Kernel warnings or general protection faults originating from drivers/gpu/drm/nouveau/nouveau_gem.c
Processes invoking DRM_IOCTL_NOUVEAU_GEM_PUSHBUF with abnormally large reloc_bo_offset values

Detection Strategies

Inventory running kernels and compare build versions against the patched commits in drivers/gpu/drm/nouveau/nouveau_gem.c
Audit local processes that hold open file descriptors on /dev/dri/card* and /dev/dri/renderD* for unexpected userspace binaries
Monitor kernel ring buffer logs for Nouveau driver faults and panics correlated with GPU workload submission

Monitoring Recommendations

Enable kernel address sanitizer (KASAN) builds in test environments to surface out-of-bounds writes triggered by malformed relocations
Forward journalctl -k and /var/log/kern.log to a centralized log platform to detect Nouveau-related crashes across the fleet
Track ioctl syscall telemetry on DRM device nodes using auditd or eBPF probes to identify anomalous submissions

How to Mitigate CVE-2026-46006

Immediate Actions Required

Apply the upstream Linux kernel patch that casts the relocation offset arithmetic to u64 before the bounds comparison
Update to a distribution kernel that incorporates the fix on systems running the Nouveau driver
Restrict access to DRM render nodes by limiting membership in the video and render groups to trusted accounts

Patch Information

The fix is committed upstream and backported to multiple stable trees. Reference the patches at Kernel Git Commit d749a9a, Kernel Git Commit e441d5c, Kernel Git Commit 2fc87d3, Kernel Git Commit 332884f5, and Kernel Git Commit fa297e9. The change replaces the 32-bit addition with a 64-bit cast so the bounds check correctly rejects overflowing offsets.

Workarounds

Blacklist the nouveau kernel module on systems that do not require it by adding blacklist nouveau to /etc/modprobe.d/ and regenerating the initramfs
Switch to the proprietary NVIDIA driver where supported, which does not share the affected code path
Remove permissions on /dev/dri/renderD* for untrusted local users to reduce the attack surface

bash

# Disable the Nouveau driver until the patched kernel is deployed
echo 'blacklist nouveau' | sudo tee /etc/modprobe.d/blacklist-nouveau.conf
echo 'options nouveau modeset=0' | sudo tee -a /etc/modprobe.d/blacklist-nouveau.conf
sudo update-initramfs -u
sudo reboot