In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM… (CVE-2026-98517)

The vulnerability in the Linux kernel's Nouveau DRM driver involves a use-after-free (UAF) condition in the nouveau_uvmm_sm function. Specifically, when a buffer object (BO) resides in TTM_PL_SYSTEM memory placement, the code erroneously treats the BO's resource pointer as a struct nouveau_mem, which is only valid for VRAM and TT resources. This misinterpretation causes the code to read beyond the allocated resource memory, triggering a KASAN slab-use-after-free error. The issue was identified through kernel address sanitizer reports and has been resolved in the kernel.

This vulnerability leads to a kernel use-after-free condition that can cause kernel crashes or undefined behavior. While the detailed impact is not explicitly stated, use-after-free bugs in kernel drivers can potentially be leveraged for privilege escalation or denial of service. No known exploits in the wild have been reported.

A fix for this vulnerability has been applied in the Linux kernel. Users should update their kernel to a version that includes this patch. Since this is a kernel-level issue, applying the official kernel update is the recommended remediation.