CVE-2026-98511: Linux kernel · drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in a6e755acf85793a7b4d29ba27b5421af1087263f : update Linux kernel when convenient.
Data as of 26 Oct 2026, 17:16 UTC
Rated Low by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in a6e755acf85793a7b4d29ba27b5421af1087263f, 9924c1d64405be8d10b906368dfb1cfe0d0c6bf0, 189ffc7b6cad6390c0695031cb6c7c63472981e8 +4
Exploitation evidence
Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
A fix for this issue is available in the Linux kernel as indicated by multiple fixed commits. Users and administrators should update to a kernel version that includes these fixes to resolve the incorrect pin count handling in the nouveau driver.
Description
A vulnerability in the Linux kernel's nouveau DRM driver caused an incorrect increment of the pin count on a failed re-pin operation in nouveau_bo_pin_locked(). This leads to a warning triggered in ttm_bo_release() due to an inconsistent pin count. The issue was discovered through fuzzing and has been fixed in subsequent kernel commits.
References
- git.kernel.org/stable/c/a6e755acf85793a7b4d29ba27b5421af1087263f (opens in a new tab)
- git.kernel.org/stable/c/5cb7109f0f5f1b47b172e2d5b868d4ce3ae687f8 (opens in a new tab)
- git.kernel.org/stable/c/9924c1d64405be8d10b906368dfb1cfe0d0c6bf0 (opens in a new tab)
- git.kernel.org/stable/c/73c7093e6cc1e6b181a79e16eccc4b8d4f34d8ee (opens in a new tab)
- git.kernel.org/stable/c/19f5a5839b308697824ff46e6213a2b4cb677771 (opens in a new tab)
- git.kernel.org/stable/c/189ffc7b6cad6390c0695031cb6c7c63472981e8 (opens in a new tab)
- git.kernel.org/stable/c/6a6870d3077faa501ca97760057ddca22b68418d (opens in a new tab)