CVE-2026-46006
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A vulnerability has been identified in the Linux kernel related to a u32 overflow in the relocation bounds check in drm/nouveau. The issue occurs during offset validation, potentially leading to system instability.
Risk Assessment
This vulnerability could lead to unauthorized access or system destabilization, posing a serious threat to the integrity and availability of services within the organization.
Recommendation
It is recommended to update the Linux kernel to the latest version to mitigate this vulnerability and to monitor systems for potential exploits.
Other vulnerabilities in Linux kernel (drm/nouveau)
See all- CVE-2026-98511Low risk· EPSS 11%
In the Linux kernel's drm/nouveau driver, nouveau_bo_pin_locked() increments the buffer's pin count even when a re-pin request fails with -EBUSY due to incompatible memory domains. The extra pin count is never decremented by a matching unpin, triggering the WARN_ON_ONCE(bo->pin_count) warning in ttm_bo_release(). The issue was found while fuzzing the nouveau driver with a modified Syzkaller.
- CVE-2026-89803High
In the Linux kernel, the drm/nouveau driver's nouveau_channel_del() tore down the fence context before unsubscribing the channel-kill event. A narrow window allowed nouveau_fence_context_kill() to run on an already freed fence context, causing a use-after-free. The fix unsubscribes before tearing down dependent structures.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix u32 overflow in pushbuf reloc bounds check nouveau_gem_pushbuf_reloc_apply() validates each relocation with if (r->reloc_bo_offset + 4 > nvbo->bo.base.size) but reloc_bo_offset is __u32 (uapi/drm/nouveau_drm.h) and the integer literal 4 promotes to unsigned int, so the addition is performed in 32 bits and wraps before the comparison against the size_t bo size. Cast to u64 so the addition happens in 64-bit arithmetic. [ Add Fixes: tag. - Danilo ]
Vulnerability data from NVD (NIST) · CISA KEV · EPSS