In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix double-free in nvif_vmm_dtor On failure, nouveau_cli_init()… (CVE-2026-98515)

The vulnerability in the Linux kernel nouveau DRM driver involves a double-free condition in the nvif_vmm_dtor function. When nouveau_cli_init() fails, it calls nouveau_cli_fini() to clean up, which frees vmm->page memory. Subsequently, nouveau_drm_open() also triggers nouveau_cli_fini(), causing a second free of the same memory because vmm->page is not cleared after the first free. This double-free can lead to kernel memory corruption. The issue was identified by fuzzing with Syzkaller and has been resolved in the Linux kernel source.

The double-free vulnerability can cause kernel memory corruption, potentially leading to system instability or crashes. There is no information about active exploitation in the wild. The impact is limited to systems running the affected nouveau DRM driver in the Linux kernel.

A fix for this double-free vulnerability has been applied in the Linux kernel. Users and administrators should update to the latest Linux kernel version that includes this patch to remediate the issue. No additional mitigation steps are indicated.