CVE-2026-89803

A flaw was found in the Linux kernel's drm/nouveau driver. During the channel teardown process, the channel-kill event subscription is not properly unsubscribed before its associated fence context is freed. This creates a narrow window where a kill event can be delivered to an already freed fence context, leading to a use-after-free vulnerability. A local attacker could potentially exploit this to cause system instability or a denial of service.

A use-after-free can occur in drm/nouveau channel teardown because the channel-kill event subscription remains active after the fence context has already been destroyed. A kill event delivered in this narrow window can run nouveau_channel_killed and reach nouveau_fence_context_kill on chan fence, causing traversal of freed fence context state and possible kernel memory corruption. For the CVSS the PR:L is used because local access to DRM render or primary device nodes may be enough to create and destroy nouveau channels in many desktop or GPU compute deployments. The issue is not network reachable and requires a timing race between channel destruction and a kill event. Impact is at least local denial of service via kernel crash and in the paranoid case may include confidentiality or integrity impact because the primitive is a kernel use-after-free.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.