CVE-2026-98517 Overview
CVE-2026-98517 is a use-after-free vulnerability in the Linux kernel's Nouveau DRM driver, specifically in the unified virtual memory manager (uvmm) code path. The flaw occurs when nouveau_uvmm_sm() processes a buffer object (BO) left in the TTM_PL_SYSTEM placement. The code incorrectly treats a generic struct ttm_resource as a struct nouveau_mem, causing an out-of-bounds read past the end of the allocation. KASAN flagged the issue as a slab-use-after-free Read in nouveau_uvmm_sm, triggered through the GPU scheduler work queue during a bind job.
Critical Impact
Local workloads invoking Nouveau GEM ioctls can trigger kernel memory corruption, leading to information disclosure or denial of service on affected systems.
Affected Products
- Linux kernel builds shipping the Nouveau DRM driver with nouveau_uvmm support
- Distributions tracking mainline kernel versions prior to the fixed commits listed below
- Systems using Nouveau for NVIDIA GPU acceleration where userspace can issue DRM_IOCTL_NOUVEAU_GEM_NEW and bind operations
Discovery Timeline
- 2026-10-18 - CVE-2026-98517 published to NVD
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-98517
Vulnerability Analysis
The defect lives in drivers/gpu/drm/nouveau/nouveau_uvmm.c. During a bind job, nouveau_uvmm_sm() invokes op_map(), which forwards bo->resource through nouveau_mem() into nouveau_uvma_map(). The downstream helper nouveau_uvmm_vmm_map() then dereferences mem->mem.type. This access is only valid when the backing resource is a struct nouveau_mem, which is true for VRAM and TT placements. When the buffer object remains in TTM_PL_SYSTEM, bo->resource points to a plain struct ttm_resource that is smaller than struct nouveau_mem. The subsequent field read runs past the end of the resource allocation and reads freed or unrelated slab memory. KASAN classified the condition as a slab use-after-free read of size 1.
Root Cause
The root cause is an unchecked type assumption. The code converts a ttm_resource pointer into a nouveau_mem pointer without first validating the placement. For TTM_PL_SYSTEM buffer objects, no nouveau_mem wrapper exists, so the cast exposes adjacent slab bytes.
Attack Vector
A local user with access to the Nouveau DRM device node can allocate a GEM object through nouveau_gem_ioctl_new, keep it in system memory, and schedule a UVMM bind operation. The resulting worker (drm_sched_run_job_work) executes nouveau_uvmm_bind_job_run and triggers the invalid read. The vulnerability requires local access but does not require elevated privileges beyond DRM device permissions.
No verified exploit code is published. The crash trace from the kernel KASAN report is the authoritative technical reference. See the upstream fix commits for the sanitized patch logic.
Detection Methods for CVE-2026-98517
Indicators of Compromise
- Kernel log entries containing KASAN: slab-use-after-free in nouveau_uvmm_vmm_map or nouveau_uvmm_sm
- Unexpected oops or warnings sourced from drivers/gpu/drm/nouveau/nouveau_uvmm.c lines 152, 199, 849, or 903
- Workqueue stack traces showing nouveau_sched_wq_* running drm_sched_run_job_work immediately before a fault
Detection Strategies
- Enable KASAN on test and staging kernels to catch the invalid read before it reaches production
- Audit userspace processes that open /dev/dri/renderD* on Nouveau systems and issue GEM allocation plus bind ioctls
- Correlate dmesg crash signatures against the running kernel version to confirm whether the patched commits are present
Monitoring Recommendations
- Forward kernel ring buffer events to a centralized logging pipeline and alert on nouveau_uvmm KASAN or BUG strings
- Track kernel package versions across the fleet and flag hosts still running pre-patch builds of the Nouveau driver
- Monitor GPU scheduler worker crashes and repeated nouveau_drm_ioctl failures that may indicate exploitation attempts
How to Mitigate CVE-2026-98517
Immediate Actions Required
- Upgrade to a Linux kernel build that includes the upstream Nouveau fix for nouveau_uvmm_sm
- Restrict access to /dev/dri/renderD* and /dev/dri/card* so only trusted local users can submit DRM ioctls
- Blacklist the nouveau module on hosts that do not require open-source NVIDIA graphics acceleration
Patch Information
The fix is distributed across the stable kernel trees in the following commits: Kernel Git Commit 0d29bf5, Kernel Git Commit 1245b4b, Kernel Git Commit 3359a37, Kernel Git Commit 34d9dfa, and Kernel Git Commit 5b2fffb. The patches gate the nouveau_mem() conversion on the resource placement so TTM_PL_SYSTEM buffer objects no longer trigger the invalid cast.
Workarounds
- Unload the nouveau kernel module (modprobe -r nouveau) on systems that can tolerate loss of open-source NVIDIA graphics support
- Switch affected hosts to the proprietary NVIDIA driver, which does not use the vulnerable nouveau_uvmm code path
- Apply mandatory access controls that prevent untrusted local accounts from opening DRM render nodes until the kernel patch is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
