In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: RCU-free the scheduler-containing nouveau_sched struct… (CVE-2026-98512)

The vulnerability in the Linux kernel's drm/nouveau driver arises from improper freeing of the nouveau_sched struct, which embeds a drm_gpu_scheduler. The nouveau_sched_destroy() function calls nouveau_sched_fini() and then frees the struct with kfree(), but the scheduler fence exported to userspace can still reference the freed memory after destruction. This leads to a use-after-free condition detectable by Kernel Address Sanitizer (KASAN). The fix involves freeing the scheduler-containing object with kfree_rcu() to respect the dma-fence lifetime contract, ensuring the data backing a signaled fence remains valid for an RCU grace period.

The vulnerability allows unprivileged users to cause a kernel use-after-free read via the SYNC_IOC_FILE_INFO ioctl, potentially leading to kernel memory corruption or crashes. While no known exploits are reported, the flaw could be leveraged for denial of service or information disclosure in the kernel space.

A fix is available that changes the freeing method of the nouveau_sched struct from kfree() to kfree_rcu(), ensuring safe memory reclamation after an RCU grace period. Users should update their Linux kernel to a version that includes this patch. No additional mitigations are specified.