CVE-2026-89804 Overview
CVE-2026-89804 affects the Linux kernel's Nouveau DRM driver, specifically the device memory (dmem) subsystem responsible for GPU device-private memory migration. The vulnerability stems from mismatched Direct Memory Access (DMA) unmap sizes when handling large folios during Transparent Huge Page (THP) migration. Two teardown paths in nouveau_dmem_migrate_to_ram() and nouveau_dmem_migrate_copy_one() pass a literal PAGE_SIZE to dma_unmap_page() instead of the saved dma_info->size. For compound folios with order greater than zero, this unmaps less memory than was originally mapped, leaking IOMMU/IOVA mappings on affected systems using NVIDIA GPUs with the open-source Nouveau driver.
Critical Impact
Local authenticated users on systems with the Nouveau driver may exploit this IOMMU mapping leak to affect confidentiality, integrity, and availability of the host.
Affected Products
- Linux kernel versions containing the Nouveau drm/nouveau/dmem device-private THP migration code
- Systems with NVIDIA GPUs using the open-source Nouveau DRM driver
- Kernel builds with CONFIG_DRM_NOUVEAU and device-private memory migration enabled
Discovery Timeline
- 2026-09-16 - CVE-2026-89804 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89804
Vulnerability Analysis
The flaw resides in the Nouveau DRM driver's device memory management code, which handles migration of pages between system RAM and GPU device-private memory. Device-private THP migration maps migration buffers using page_size() and records that length in dma_info->size. For a compound folio, page_size() equals PAGE_SIZE << order, which can significantly exceed a single 4KB page.
Two teardown sites incorrectly pass a literal PAGE_SIZE value to dma_unmap_page() instead of using the previously recorded size: the success path in nouveau_dmem_migrate_to_ram() and the copy-error path in nouveau_dmem_migrate_copy_one(). For any folio with an order greater than zero, this size mismatch results in unmapping less memory than was originally mapped.
Root Cause
The root cause is inconsistent use of size tracking across mapping and unmapping operations. The mapping side correctly stores the full folio size in dma_info->size, and other unmap sites in nouveau_dmem_migrate_chunk() and nouveau_dmem_evict_chunk() already consume that saved size. The two affected sites instead use the fixed PAGE_SIZE constant, leaving IOMMU/IOVA translation entries in place for the unmapped remainder. This produces a slow leak of DMA mappings tied to GPU migration workloads.
Attack Vector
Exploitation requires local access with low privileges on a system running the vulnerable Nouveau driver. An attacker triggers repeated device-private THP migrations, for example by allocating and migrating GPU-backed memory regions using workloads that engage the HMM migration path. Each qualifying migration leaks IOMMU/IOVA entries, gradually exhausting IOMMU resources or leaving stale device-side mappings that impact system integrity and availability. The scope change indicates cross-boundary impact between the calling process and kernel-managed DMA state.
No verified public exploit code is available. See the upstream commits for the full patch content: Kernel.org Commit 4deb29b and Kernel.org Commit caa1bc2.
Detection Methods for CVE-2026-89804
Indicators of Compromise
- Growing IOMMU/IOVA allocation counts on hosts running the Nouveau driver without a corresponding increase in legitimate device workload.
- DMA mapping exhaustion warnings or iommu failure messages in dmesg correlated with GPU memory migration activity.
- Unexpected latency or failure in HMM-based GPU workloads after prolonged uptime.
Detection Strategies
- Inventory Linux hosts running kernels with the Nouveau DRM driver enabled and compare against the patched commit hashes.
- Monitor kernel logs for nouveau_dmem migration errors and IOMMU allocation warnings during GPU compute workloads.
- Track long-running GPU workloads that exercise THP migration to identify systems most exposed to the leak.
Monitoring Recommendations
- Collect kernel telemetry, dmesg output, and IOMMU counters through an endpoint or SIEM pipeline for baseline comparison.
- Alert on repeated dma_unmap_page mismatches or on IOMMU pool exhaustion events on GPU hosts.
- Correlate GPU workload activity with kernel resource metrics to identify anomalous DMA mapping growth over time.
How to Mitigate CVE-2026-89804
Immediate Actions Required
- Apply the upstream kernel patches referenced in the Nouveau commits as soon as vendor-supported builds are available.
- Identify all hosts running Nouveau with device-private memory migration and prioritize patching for GPU compute nodes.
- Restrict local access on affected systems, since exploitation requires an authenticated local user.
Patch Information
The fix updates the two teardown sites in nouveau_dmem_migrate_to_ram() and nouveau_dmem_migrate_copy_one() to use the saved dma_info->size when calling dma_unmap_page(), matching the size used at mapping time. Patch details are available at Kernel.org Commit 4deb29b and Kernel.org Commit caa1bc2. Consult your Linux distribution's advisory feed for backported package versions.
Workarounds
- Where feasible, disable or blacklist the Nouveau driver on systems that do not require GPU functionality until patched kernels are deployed.
- Limit GPU workloads that trigger device-private THP migration on unpatched hosts to reduce leak accumulation.
- Reboot affected systems periodically to reclaim leaked IOMMU/IOVA mappings as a temporary operational control.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
