CVE-2025-38187

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: fix a use-after-free in r535_gsp_rpc_push()

The RPC container is released after being passed to r535_gsp_rpc_send().

When sending the initial fragment of a large RPC and passing the caller's RPC container, the container will be freed prematurely. Subsequent attempts to send remaining fragments will therefore result in a use-after-free.

Allocate a temporary RPC container for holding the initial fragment of a large RPC when sending. Free the caller's container when all fragments are successfully sent.

[ Rebase onto Blackwell changes. - Danilo ]

Red Hat Enterprise Linux is not affected by this vulnerability because the affected Nouveau driver subsystem was introduced in upstream releases that have not been incorporated into supported kernels. In affected upstream environments, a local authenticated user could cause a denial of service or potentially execute arbitrary code by triggering a use-after-free condition during GPU firmware communications. Exploitation is constrained to systems containing compatible NVIDIA graphics hardware actively running the Nouveau driver.