CVE-2026-98517ImportantLocalRevised 21 Oct

drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM

MSRC advisory NVD CVE.org

Assessment

Severity: Important
CVSS base score: 7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Impact: Not stated
EPSS, next 30 days: Not scored yet
Public exploit code: No Nuclei template lists it
Exploitability: Not assessed
Publicly disclosed: No
Customer action: Required: apply the update
Component: Mariner
Weakness: —
Issued by: Linux
Published: 20 Oct 2026 · October 2026
Last revised: 21 Oct 2026Information published.

CVSS 3.1 base metricsRed raises the risk · green lowers it

Attack vector: LocalAV:L
Attack complexity: LowAC:L
Privileges required: LowPR:L
User interaction: NoneUI:N
Scope: UnchangedS:U
Confidentiality: HighC:H
Integrity: NoneI:N
Availability: HighA:H

Updates that fix it

0 KBs

No KB listed

MSRC lists no downloadable update, which usually means a service-side fix or a release-notes update. Check the MSRC advisory.

Affected products

1 affected product

azl3 kernel 6.6.157.1-1 on Azure Linux 3.0

What changed

First observed 20 Oct 2026

23 Oct 2026 · 09:33:49 UTC Public exploit codeUnknown: exploit-code evidence is incomplete or retained → No Nuclei template listed
23 Oct 2026 · 09:33:49 UTC CISA KEVUnknown: catalog evidence is incomplete or retained → Not listed in the collected catalog
23 Oct 2026 · 09:33:49 UTC Source coverage: public-exploit-codeIncomplete → Current
23 Oct 2026 · 09:33:49 UTC Source coverage: first-epssIncomplete → Current
23 Oct 2026 · 09:33:49 UTC Source coverage: cisa-kevIncomplete → Current
23 Oct 2026 · 09:33:49 UTC Source coverage: msrc-cvrfIncomplete → Current
23 Oct 2026 · 08:31:50 UTC Public exploit codeNo Nuclei template listed → Unknown: exploit-code evidence is incomplete or retained
23 Oct 2026 · 08:31:50 UTC CISA KEVNot listed in the collected catalog → Unknown: catalog evidence is incomplete or retained
23 Oct 2026 · 08:31:50 UTC Source coverage: public-exploit-codeCurrent → Incomplete
23 Oct 2026 · 08:31:50 UTC Source coverage: first-epssCurrent → Incomplete
23 Oct 2026 · 08:31:50 UTC Source coverage: cisa-kevCurrent → Incomplete
23 Oct 2026 · 08:31:50 UTC Source coverage: msrc-cvrfCurrent → Incomplete

Show 1 more recent changes

21 Oct 2026 · 20:45:25 UTCLast revised 20 Oct 2026 01:07 UTC → 21 Oct 2026 18:37 UTC

The most recent 100 field changes are listed. Complete recorded revisions are kept separately.

Cite this recorded revision to keep the same title, summary, facts and links when the page changes.

A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.

Explore global source statements, affected packages and advisory history for CVE-2026-98517. The catalog has a separate collection scope from Microsoft release records.

Collected exploitation and prediction evidence

Risk source coverage

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

cve-program · CVE-2026-98517

Published

drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM nouveau_uvmm_sm() calls op_map(), which passes bo->resource through nouveau_mem() to nouveau_uvma_map(). nouveau_uvmm_vmm_map() then reads mem->mem.type. But this is only valid when bo->resource is backed by struct nouveau_mem, as is the case for VRAM and TT resources. If the BO is left in TTM_PL_SYSTEM, bo->resource is only a struct ttm_resource. Treating it as struct nouveau_mem makes the mem->mem.type read past the end of the resource, causing a KASAN: slab-use-after-free Read in nouveau_uvmm_sm report: BUG: KASAN: slab-use-after-free in nouveau_uvmm_vmm_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:152 [inline] BUG: KASAN: slab-use-after-free in nouveau_uvma_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:199 [inline] BUG: KASAN: slab-use-after-free in op_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:849 [inline] BUG: KASAN: slab-use-after-free in nouveau_uvmm_sm.constprop.0+0x6ab/0x900 drivers/gpu/drm/nouveau/nouveau_uvmm.c:903 Read of size 1 at addr ffff888127d3e3a0 by task kworker/0:1/11 CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 7.2.0 #5 PREEMPT(lazy) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: nouveau_sched_wq_2224 drm_sched_run_job_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x95/0xe0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcb/0x5a0 mm/kasan/report.c:482 kasan_report+0xca/0x100 mm/kasan/report.c:595 nouveau_uvmm_vmm_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:152 [inline] nouveau_uvma_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:199 [inline] op_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:849 [inline] nouveau_uvmm_sm.constprop.0+0x6ab/0x900 drivers/gpu/drm/nouveau/nouveau_uvmm.c:903 nouveau_uvmm_sm_unmap drivers/gpu/drm/nouveau/nouveau_uvmm.c:932 [inline] nouveau_uvmm_bind_job_run+0xd6/0x250 drivers/gpu/drm/nouveau/nouveau_uvmm.c:1532 nouveau_job_run drivers/gpu/drm/nouveau/nouveau_sched.c:350 [inline] nouveau_sched_run_job+0x62/0xd0 drivers/gpu/drm/nouveau/nouveau_sched.c:364 drm_sched_run_job_work+0x356/0xa10 drivers/gpu/drm/scheduler/sched_main.c:1061 process_one_work+0x8a5/0x1900 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5dd/0xd80 kernel/workqueue.c:3486 kthread+0x31d/0x420 kernel/kthread.c:436 ret_from_fork+0x662/0x940 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Allocated by task 2224 on cpu 0 at 66.550027s: kasan_save_stack+0x24/0x50 mm/kasan/common.c:57 kasan_save_track+0x17/0x60 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5334 [inline] __kmalloc_noprof+0x304/0x7c0 mm/slub.c:5359 _kmalloc_noprof include/linux/slab.h:992 [inline] dma_resv_list_alloc+0x27/0x90 drivers/dma-buf/dma-resv.c:106 dma_resv_reserve_fences+0x60e/0xa30 drivers/dma-buf/dma-resv.c:205 ttm_bo_alloc_resource+0x12c/0xbd0 drivers/gpu/drm/ttm/ttm_bo.c:721 ttm_bo_validate+0x1bc/0x4a0 drivers/gpu/drm/ttm/ttm_bo.c:856 ttm_bo_init_reserved+0x2c3/0x570 drivers/gpu/drm/ttm/ttm_bo.c:970 nouveau_bo_init+0x159/0x2c0 drivers/gpu/drm/nouveau/nouveau_bo.c:359 nouveau_gem_new+0x234/0x5f0 drivers/gpu/drm/nouveau/nouveau_gem.c:272 nouveau_gem_ioctl_new+0x1eb/0x420 drivers/gpu/drm/nouveau/nouveau_gem.c:352 drm_ioctl_kernel+0x192/0x350 drivers/gpu/drm/drm_ioctl.c:817 drm_ioctl+0x4f8/0xb40 drivers/gpu/drm/drm_ioctl.c:914 nouveau_drm_ioctl+0xea/0x2c0 drivers/gpu/drm/nouveau/nouveau_drm.c:1338 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x180/0x1d0 fs/ioctl.c:583 do_syscall_x64 ar ---truncated---

Source published: 18 Oct 2026 15:17:35 UTC
Source modified: 24 Oct 2026 14:09:14 UTC
Observed here: 24 Oct 2026 16:17:04 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H