CVE-2026-89801

A flaw was found in the Linux kernel's drm/nouveau/uvmm component. A local attacker could exploit a use-after-free vulnerability by triggering a premature region free during a failed OP_UNMAP_SPARSE operation. This occurs because certain failure paths do not properly clear a region pointer, leading to the system attempting to free a region that is still in use by another process. Successful exploitation could lead to system instability or potentially privilege escalation.

A use after free can occur in the nouveau UVMM VM_BIND path because OP_UNMAP_SPARSE stores a region pointer returned by nouveau_uvma_region_find without taking a reference. On selected failure paths, such as a busy or dirty region check or a drm_gpuvm_sm_unmap_ops_create failure, op reg remains set even though the submit path is unwound. Cleanup can then remove and put a region that the failing job did not create or own, dropping the sole tree reference and freeing a live region. A later cleanup or another job using the same region can dereference the freed object, causing a kernel crash and possible memory corruption. For the CVSS the PR:L is used because exploitation requires local access to the nouveau DRM device or render node, but does not inherently require full administrative privileges. The issue is not network reachable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.