In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: pin VRAM for the whole registered range Commit c32287471077… (CVE-2026-98518)

The vulnerability in the Linux kernel's nouveau DRM driver stemmed from a commit that increased the size of the device-private region registered by nouveau_dmem_chunk_alloc() without correspondingly resizing the VRAM buffer object backing that region. As a result, nouveau_dmem_page_addr() could return addresses pointing to VRAM outside the buffer object for pages beyond the first chunk. The fix involved adjusting the buffer object size to match the full registered region, preventing out-of-bounds VRAM references.

The vulnerability could lead to incorrect VRAM address resolution, potentially causing memory corruption or unauthorized access to VRAM outside the intended buffer. However, no specific exploitation details or active exploits are reported.

A fix has been applied in the Linux kernel to correctly size the VRAM buffer object to the entire registered region. Users should update to the patched kernel version containing commit c32287471077 or later to remediate this issue.