CVE-2026-68271: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68271 Overview

CVE-2026-68271 is a Linux kernel vulnerability in the drm/nouveau GPU driver. The flaw affects nouveau_uvmm_vm_bind_ucopy() and nouveau_exec_ucopy(), which place their error cleanup labels in allocation order rather than reverse allocation order. When u_memcpya() fails for in_sync.s, the cleanup path calls u_free() on a pointer still holding an ERR_PTR value. Because ERR_PTR values are not caught by ZERO_OR_NULL_PTR(), kvfree() dereferences the invalid pointer and can trigger a kernel oops. A failure on out_sync.s produces a memory leak instead by skipping the first allocation's cleanup.

Critical Impact
A local unprivileged process invoking the nouveau uAPI can trigger a kernel oops via an invalid ERR_PTR dereference during error cleanup, resulting in denial of service.

Affected Products

Linux kernel drm/nouveau driver in nouveau_uvmm_vm_bind_ucopy()
Linux kernel drm/nouveau driver in nouveau_exec_ucopy()
Stable branches referenced by upstream fix commits 2473ac3, 4e109fa, ab99ead, e15c25c, and ebbaf64

Discovery Timeline

2026-08-10 - CVE-2026-68271 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68271

Vulnerability Analysis

The vulnerability resides in two user-copy helper routines in the Nouveau Direct Rendering Manager (DRM) driver. Both functions allocate multiple resources sequentially and rely on goto labels to release them on failure. The labels are ordered incorrectly, so an early failure jumps into a cleanup sequence that operates on a pointer variable that was not fully initialized to a valid heap object.

Specifically, when u_memcpya() fails while copying in_sync.s from user space, it returns an ERR_PTR encoded error value and assigns it to args->in_sync.s. The error path then falls through to err_free_ins, which calls u_free() on that field. u_free() uses kvfree(), which validates only null and zero pointers via ZERO_OR_NULL_PTR(). Encoded error pointers pass that guard and are dereferenced as if they were valid kernel addresses, producing an oops.

The symmetric case, a failure while copying out_sync.s, jumps to err_free_ins and skips the label that would free the first successful allocation. This results in a memory leak of previously allocated buffers. Both defects stem from cleanup labels arranged in allocation order rather than reverse allocation order.

Root Cause

The root cause is incorrect ordering of error-handling labels combined with an unchecked assumption that partially initialized pointers are either null or valid. The pattern mixes ERR_PTR sentinel values with pointers passed to kvfree(), which does not recognize encoded errors [CWE-476, CWE-401].

Attack Vector

A local process with access to the Nouveau DRM device node can invoke the affected uAPI ioctls with crafted arguments that cause u_memcpya() to fail on in_sync.s. The failure triggers dereference of an ERR_PTR value inside kvfree(), producing a kernel oops and denial of service on systems using the Nouveau driver.

No verified public exploit code is available. See the upstream commits referenced below for the exact patch details: Linux Kernel Commit 2473ac3, Linux Kernel Commit 4e109fa, Linux Kernel Commit ab99ead, Linux Kernel Commit e15c25c, and Linux Kernel Commit ebbaf64.

Detection Methods for CVE-2026-68271

Indicators of Compromise

Kernel oops or BUG entries in dmesg referencing nouveau_uvmm_vm_bind_ucopy or nouveau_exec_ucopy in the call stack
Faulting address in kvfree() with a value resembling an encoded ERR_PTR (high kernel address near -MAX_ERRNO)
Repeated segfaults or process termination for user-space clients issuing Nouveau DRM ioctls

Detection Strategies

Monitor kernel logs on systems running the Nouveau driver for oops signatures involving the two affected functions
Baseline kernel version and module hashes across the fleet and flag hosts running unpatched drm/nouveau builds
Correlate GPU-related process crashes with kernel ring buffer errors to identify triggering workloads

Monitoring Recommendations

Forward /var/log/kern.log and journalctl -k output to a centralized logging platform for oops pattern searches
Track invocation counts of DRM_IOCTL_NOUVEAU_VM_BIND and DRM_IOCTL_NOUVEAU_EXEC on multi-tenant systems
Alert on kernel taint flag changes (/proc/sys/kernel/tainted) that indicate a prior oops occurred

How to Mitigate CVE-2026-68271

Immediate Actions Required

Apply the upstream stable kernel updates that include the referenced fix commits to any host running the Nouveau driver
Inventory systems using NVIDIA GPUs with the open-source Nouveau driver, including workstations and virtualization hosts
Restrict access to /dev/dri/* device nodes to trusted users on shared systems until patches are deployed

Patch Information

The fix reorders the cleanup labels in nouveau_uvmm_vm_bind_ucopy() and nouveau_exec_ucopy() so resources are released in reverse allocation order. This ensures that a pointer still holding an ERR_PTR is never passed to u_free(). The corrected code is available in upstream commits 2473ac3, 4e109fa, ab99ead, e15c25c, and ebbaf64.

Workarounds

Blacklist the nouveau kernel module on systems where the driver is not required, using /etc/modprobe.d/blacklist-nouveau.conf
Switch to the proprietary NVIDIA driver where policy permits, which does not use the Nouveau code path
Limit local user access to hosts exposing the Nouveau DRM interface until stable kernel updates land

bash

# Blacklist the nouveau driver until the patched kernel is installed
echo 'blacklist nouveau' | sudo tee /etc/modprobe.d/blacklist-nouveau.conf
echo 'options nouveau modeset=0' | sudo tee -a /etc/modprobe.d/blacklist-nouveau.conf
sudo update-initramfs -u
sudo reboot