CVE-2026-89802
Low risk· EPSS 9%Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In the Linux kernel, the drm/nouveau/uvmm driver had a NULL dereference when unwinding an OP_MAP_SPARSE op. If a later op in the same job fails, the reverse unwind loop calls drm_gpuva_ops_free() on op->ops, which remains NULL for a successfully processed sparse map, causing an oops. The fix adds an IS_ERR_OR_NULL() guard.
Risk Assessment
Any render-node fd holder can trigger a kernel oops (denial of service) via a crafted bind job. Affects systems with NVIDIA GPUs using uvmm.
Recommendation
Update the Linux kernel to a version with the drm/nouveau/uvmm fix. Restrict render-node access for untrusted users.
Other vulnerabilities in Linux kernel (drm/nouveau/uvmm)
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op Each bind_job_op is zeroed by kzalloc_obj() in bind_job_op_from_uop(), and the OP_MAP_SPARSE case in nouveau_uvmm_bind_job_submit() only creates a region, so op->ops stays NULL for a successfully processed sparse map. If a later op in the same job fails, the reverse unwind loop revisits that op and calls drm_gpuva_ops_free(&uvmm->base, op->ops) unconditionally. drm_gpuva_ops_free() dereferences its argument right away (list_for_each_entry_safe on &ops->list), so a NULL op->ops oopses. The path is reachable by any render-node fd holder, since NOUVEAU_VM_BIND is DRM_RENDER_ALLOW. Guard the free with IS_ERR_OR_NULL(), as nouveau_uvmm_bind_job_cleanup() already does for the identical free.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS