CVE-2026-89553: Linux Kernel Nouveau Use-After-Free Flaw

CVE-2026-89553 Overview

CVE-2026-89553 is a use-after-free vulnerability in the Linux kernel's nouveau GPU driver. The flaw resides in the GEM (Graphics Execution Manager) subsystem, specifically in the non-uvmm code path of the info ioctl handler. A race condition exists between the info lookup finding a virtual memory area (VMA) and the GEM close path closing that same VMA. When these operations execute concurrently, the info ioctl can dereference a VMA that has already been freed, leading to memory corruption.

Critical Impact
A local, low-privileged user can trigger a kernel use-after-free through the nouveau GEM info ioctl, potentially enabling privilege escalation to root or kernel-level code execution.

Affected Products

Linux kernel with the nouveau DRM driver enabled
Systems using NVIDIA GPUs with the open-source nouveau driver stack
Distributions shipping affected upstream kernel versions prior to the patched commits

Discovery Timeline

2026-09-11 - CVE-2026-89553 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89553

Vulnerability Analysis

The vulnerability is a classic use-after-free [CWE-416] triggered by a race condition [CWE-362] in the nouveau DRM driver's GEM object handling. The nouveau driver exposes an info ioctl that returns metadata about buffer objects, including the associated VMA for a given GEM handle. In the non-uvmm (unified virtual memory manager) path, this lookup does not hold the buffer object reservation lock across the VMA traversal.

A second thread can invoke the GEM close path on the same buffer object, which walks and destroys the VMA list. Because the info ioctl reads the VMA pointer without synchronization against the close path, it can obtain a pointer that becomes invalid before it is dereferenced. Subsequent access to the freed VMA structure produces a use-after-free condition inside kernel memory.

Root Cause

The root cause is missing synchronization on the buffer object during VMA lookup. The upstream fix reserves the buffer object (ttm_bo_reserve / equivalent locking) around the VMA lookup in the info ioctl, ensuring the close path cannot concurrently free the VMA. Without this reservation, the lookup and free operations interleave unsafely.

Attack Vector

Exploitation requires local access with permission to open the DRM render node, typically /dev/dri/renderD*. An attacker races two threads: one repeatedly issuing the nouveau info ioctl against a GEM handle, and another closing the associated GEM object. Winning the race causes the kernel to dereference a freed VMA structure. Skilled attackers can spray the freed slab allocation with controlled data to hijack kernel control flow. The vulnerability requires no user interaction and executes entirely from an unprivileged local process on systems with nouveau loaded.

No public proof-of-concept exploit is currently available. See the upstream patch series in the Linux kernel stable tree for the corrected locking sequence.

Detection Methods for CVE-2026-89553

Indicators of Compromise

Unexpected kernel oops or panic messages referencing nouveau_gem_ioctl_info, nouveau_vma_find, or nouveau_bo in dmesg or /var/log/kern.log
KASAN reports flagging use-after-free reads or writes inside nouveau VMA structures
Unprivileged processes opening /dev/dri/renderD* and issuing high volumes of DRM_IOCTL_NOUVEAU_GEM_INFO calls in tight loops
Unexplained kernel crashes on workstations with NVIDIA GPUs running the nouveau driver

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test and pre-production kernels to surface use-after-free conditions in the nouveau path
Audit process telemetry for non-graphical processes accessing DRM render nodes, which is unusual on server workloads
Correlate kernel crash dumps with running process inventory to identify potential exploitation attempts

Monitoring Recommendations

Ingest kernel logs into a centralized SIEM and alert on repeated nouveau subsystem faults
Monitor for local privilege escalation indicators such as new SUID binaries, unexpected UID transitions, or root-owned processes spawned from unprivileged parents
Track kernel version and patch level across the fleet to identify hosts still exposed to CVE-2026-89553

How to Mitigate CVE-2026-89553

Immediate Actions Required

Update the Linux kernel to a version containing the upstream fix commits listed in the NVD references
On systems that do not require GPU acceleration, unload the nouveau module and blacklist it to remove the attack surface entirely
Restrict access to /dev/dri/renderD* to trusted user groups where feasible
Prioritize patching multi-user systems, shared workstations, and container hosts where local access is broadly available

Patch Information

The fix has been merged across multiple stable branches. The patch reserves the buffer object around the VMA lookup in nouveau_gem_ioctl_info, closing the race window. Relevant commits include 208867763843, 5e17160d41d9, e05c28bd6043, e60466011ac3, and ff110e85837d. Apply vendor-provided kernel updates from your distribution as soon as they are available.

Workarounds

Blacklist the nouveau driver on systems that do not need it by adding blacklist nouveau to /etc/modprobe.d/blacklist-nouveau.conf and rebuilding the initramfs
Switch to the proprietary NVIDIA driver on affected workstations, which does not use the nouveau code path
Apply strict file permissions on DRM device nodes to limit which local users can invoke the vulnerable ioctl

bash

# Blacklist the nouveau driver to eliminate the vulnerable code path
echo "blacklist nouveau" | sudo tee /etc/modprobe.d/blacklist-nouveau.conf
echo "options nouveau modeset=0" | sudo tee -a /etc/modprobe.d/blacklist-nouveau.conf

# Rebuild initramfs (Debian/Ubuntu)
sudo update-initramfs -u

# Rebuild initramfs (RHEL/Fedora)
sudo dracut --force

# Reboot to apply
sudo reboot