CVE-2026-89553

A flaw was found in the Linux kernel's nouveau/gem component. A race condition exists where the graphics execution manager (GEM) close path can close a virtual memory area (VMA) while an information lookup is still trying to access it. This timing issue leads to a use-after-free vulnerability, which could allow a local attacker to potentially achieve arbitrary code execution or cause a denial of service.

A use-after-free race exists in the nouveau GEM info ioctl path because nouveau_gem_info() can look up a VMA while the GEM close path concurrently closes and frees the same VMA. A local process with access to the nouveau DRM device can potentially trigger the race by invoking the info ioctl while another path closes the GEM mapping. For the CVSS the PR:L is used because reliable triggering requires local code execution and access to the DRM device, not full administrator privileges. The issue is not network reachable. Impact is at least a local denial of service via kernel crash or memory fault, with possible limited confidentiality exposure from stale VMA data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.