CVE-2026-98515

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: fix double-free in nvif_vmm_dtor

On failure, nouveau_cli_init() calls nouveau_cli_fini() to tear

the client down. Then, nouveau_drm_open() also enters into its

cleanup path and calls nouveau_cli_fini() AGAIN. nouveau_cli_fini()

calls nouveau_vmm_fini():

void

nouveau_vmm_fini(struct nouveau_vmm *vmm)

{

nouveau_svmm_fini(&vmm->svmm);

nvif_vmm_dtor(&vmm->vmm);

vmm->cli = NULL;

}

Inside nvif_vmm_dtor(), vmm->page is freed unconditionally:

void

nvif_vmm_dtor(struct nvif_vmm *vmm)

{

kfree(vmm->page);

nvif_object_dtor(&vmm->object);

}

vmm->page is never cleared after being freed, so the second call of

nvif_vmm_dtor() will cause a double-free.

Found by fuzzing the nouveau driver with a modified Syzkaller:

BUG: KASAN: double-free in nvif_vmm_dtor+0x31/0x50 drivers/gpu/drm/nouveau/nvif/vmm.c:194

Free of addr ffff888010fcdc30 by task syz.0.173/2567

CPU: 1 UID: 0 PID: 2567 Comm: syz.0.173

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References