{"id":"CVE-2026-89802","revision":"014da976e68b443dac0b84fb6d7b9cd0","records":[{"revision":"014da976e68b443dac0b84fb6d7b9cd0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89802","aliases":[],"title":"drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op\n\nEach bind_job_op is zeroed by kzalloc_obj() in bind_job_op_from_uop(),\nand the OP_MAP_SPARSE case in nouveau_uvmm_bind_job_submit() only creates\na region, so op->ops stays NULL for a successfully processed sparse map.\n\nIf a later op in the same job fails, the reverse unwind loop revisits that\nop and calls drm_gpuva_ops_free(&uvmm->base, op->ops) unconditionally.\ndrm_gpuva_ops_free() dereferences its argument right away\n(list_for_each_entry_safe on &ops->list), so a NULL op->ops oopses. The\npath is reachable by any render-node fd holder, since NOUVEAU_VM_BIND is\nDRM_RENDER_ALLOW.\n\nGuard the free with IS_ERR_OR_NULL(), as nouveau_uvmm_bind_job_cleanup()\nalready does for the identical free.","state":0,"publishedAt":"2026-09-16T10:30:35.738+00:00","modifiedAt":"2026-10-21T12:48:45.811+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/nouveau/nouveau_uvmm.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"b88baab828713ce0b49b185444b2ee83bed373a8\",\n                            \"lessThan\": \"d8ec34618e71018fd7a3f73c57c6b92d71a6c7c3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b88baab828713ce0b49b185444b2ee83bed373a8\",\n                            \"lessThan\": \"3bf493cf7ed0c2b3df728977a257e0d99b4db1c6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b88baab828713ce0b49b185444b2ee83bed373a8\",\n                            \"lessThan\": \"b7dc03e09313d22a6d230b759de3b05d504c008f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b88baab828713ce0b49b185444b2ee83bed373a8\",\n                            \"lessThan\": \"3857238de6bce6c1573e8cb86c37b067e5208f05\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b88baab828713ce0b49b185444b2ee83bed373a8\",\n                            \"lessThan\": \"412a6ceb56d501ef2f8202e26ab4b5d4dfbca566\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/nouveau/nouveau_uvmm.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.6\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.6\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.160\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.51\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.5\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/d8ec34618e71018fd7a3f73c57c6b92d71a6c7c3","https://git.kernel.org/stable/c/3bf493cf7ed0c2b3df728977a257e0d99b4db1c6","https://git.kernel.org/stable/c/b7dc03e09313d22a6d230b759de3b05d504c008f","https://git.kernel.org/stable/c/3857238de6bce6c1573e8cb86c37b067e5208f05","https://git.kernel.org/stable/c/412a6ceb56d501ef2f8202e26ab4b5d4dfbca566"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89802","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89802","identifiers":["CVE-2026-89802"]},"retained":false,"historicalAffected":[]}],"coverage":[]}