Linux kernel (drm/nouveau) vulnerabilities

In the Linux kernel's drm/nouveau driver, nouveau_bo_pin_locked() increments the buffer's pin count even when a re-pin request fails with -EBUSY due to incompatible memory domains. The extra pin count is never decremented by a matching unpin, triggering the WARN_ON_ONCE(bo->pin_count) warning in ttm_bo_release(). The issue was found while fuzzing the nouveau driver with a modified Syzkaller.

In the Linux kernel, the drm/nouveau driver's nouveau_channel_del() tore down the fence context before unsubscribing the channel-kill event. A narrow window allowed nouveau_fence_context_kill() to run on an already freed fence context, causing a use-after-free. The fix unsubscribes before tearing down dependent structures.

A vulnerability has been identified in the Linux kernel related to a u32 overflow in the relocation bounds check in drm/nouveau. The issue occurs during offset validation, potentially leading to system instability.