CVE-2026-89802: Linux Kernel Nouveau Driver UAF Vulnerability

CVE-2026-89802 Overview

CVE-2026-89802 is a NULL pointer dereference vulnerability in the Linux kernel's Nouveau GPU driver, specifically in the userspace virtual memory manager (uvmm) component. The flaw resides in the error-unwinding path of nouveau_uvmm_bind_job_submit() when processing an OP_MAP_SPARSE operation. Sparse map operations only create a region and leave op->ops as NULL, but the reverse unwind loop calls drm_gpuva_ops_free(&uvmm->base, op->ops) unconditionally when a later operation in the same job fails. Because drm_gpuva_ops_free() immediately dereferences its argument, the NULL pointer triggers a kernel oops. The path is reachable by any process holding a render-node file descriptor because NOUVEAU_VM_BIND is marked DRM_RENDER_ALLOW.

Critical Impact
Any local user with access to a Nouveau render node can trigger a kernel NULL pointer dereference, resulting in a denial of service on affected Linux systems.

Affected Products

Linux kernel versions containing the vulnerable drm/nouveau/uvmm implementation
Systems using Nouveau GPU driver with NOUVEAU_VM_BIND interface enabled
Distributions shipping the affected kernel prior to the referenced stable commits

Discovery Timeline

2026-09-16 - CVE-2026-89802 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89802

Vulnerability Analysis

The vulnerability lives in the Nouveau uvmm bind-job submission path. Each bind_job_op structure is zero-initialized by kzalloc_obj() inside bind_job_op_from_uop(). When the operation type is OP_MAP_SPARSE, nouveau_uvmm_bind_job_submit() only allocates a region and does not populate the op->ops list, so the pointer remains NULL after successful processing.

If a subsequent operation within the same multi-op bind job fails, the function enters its reverse unwind loop to release resources for previously processed operations. That loop calls drm_gpuva_ops_free(&uvmm->base, op->ops) without checking whether op->ops is valid. The freeing routine immediately walks &ops->list using list_for_each_entry_safe, dereferencing the NULL pointer and causing a kernel oops. This is a classic Null Pointer Dereference [CWE-476] leading to denial of service.

Root Cause

The defect is a missing guard in an error-handling path. The cleanup helper nouveau_uvmm_bind_job_cleanup() already wraps the identical free with IS_ERR_OR_NULL(), but the unwind loop in nouveau_uvmm_bind_job_submit() omitted the same check. Successfully processed sparse map operations therefore carry a legitimate NULL op->ops that later triggers the crash during rollback.

Attack Vector

Exploitation requires local access with permission to open a Nouveau render node (/dev/dri/renderD*). Because NOUVEAU_VM_BIND is exposed under DRM_RENDER_ALLOW, any unprivileged process able to open the render node can submit a crafted multi-operation bind job containing an OP_MAP_SPARSE followed by an operation that fails. The failed submission drives the vulnerable unwind loop and panics the kernel.

No verified public exploit code is available. See the upstream fix commits for technical details: Linux Kernel Commit 3857238d, Linux Kernel Commit 3bf493cf, Linux Kernel Commit 412a6ceb, and Linux Kernel Commit b7dc03e0.

Detection Methods for CVE-2026-89802

Indicators of Compromise

Kernel oops or panic messages referencing drm_gpuva_ops_free, nouveau_uvmm_bind_job_submit, or list_for_each_entry_safe in dmesg or /var/log/kern.log.
Unexpected GPU driver crashes coincident with unprivileged processes issuing DRM_IOCTL_NOUVEAU_VM_BIND calls.
Repeated segfaults or terminations of processes holding open file descriptors to /dev/dri/renderD* nodes.

Detection Strategies

Audit host telemetry for kernel panics whose stack traces include Nouveau uvmm symbols and correlate to non-root processes.
Monitor auditd for openat events on /dev/dri/renderD* by unusual user contexts, then correlate with subsequent kernel error signatures.
Inspect running kernel version against distribution advisories to identify hosts running vulnerable Nouveau uvmm code.

Monitoring Recommendations

Forward kernel ring buffer and syslog to a centralized logging platform and alert on Nouveau-related oops signatures.
Track render-node access from container workloads and unexpected user sessions on multi-tenant Linux hosts.
Baseline GPU driver crash frequency and alert on statistical anomalies that could indicate probing or exploitation attempts.

How to Mitigate CVE-2026-89802

Immediate Actions Required

Apply the upstream Linux stable kernel patches that guard the free with IS_ERR_OR_NULL() in the uvmm unwind path.
Update to a distribution kernel package that incorporates the referenced commits and reboot affected systems.
Restrict access to /dev/dri/renderD* nodes on multi-tenant systems until patches are deployed.

Patch Information

The fix adds an IS_ERR_OR_NULL() check before calling drm_gpuva_ops_free() in the unwind loop, matching the guard already present in nouveau_uvmm_bind_job_cleanup(). Patches are available in the stable tree: Linux Kernel Commit 3857238d, Linux Kernel Commit 3bf493cf, Linux Kernel Commit 412a6ceb, and Linux Kernel Commit b7dc03e0.

Workarounds

Blacklist the nouveau kernel module on systems that do not require the driver by adding blacklist nouveau to /etc/modprobe.d/.
Constrain render-node permissions using group membership and udev rules to limit exposure to trusted users only.
Use container security policies to prevent unprivileged containers from mounting or accessing /dev/dri/renderD* devices.

bash

# Configuration example: block the Nouveau driver and rebuild initramfs
echo 'blacklist nouveau' | sudo tee /etc/modprobe.d/blacklist-nouveau.conf
echo 'options nouveau modeset=0' | sudo tee -a /etc/modprobe.d/blacklist-nouveau.conf
sudo update-initramfs -u
sudo reboot