{"id":"CVE-2026-98512","title":"drm/nouveau: RCU-free the scheduler-containing nouveau_sched","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: RCU-free the scheduler-containing nouveau_sched\n\nstruct nouveau_sched embeds a struct drm_gpu_scheduler (base).\nnouveau_sched_destroy() calls nouveau_sched…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 5f03a507b29e44a848f315c7240c19894dd8be4f < 40edf5eefc3fd94592a91d6eb074d4fc6f606c75","Linux >= 5f03a507b29e44a848f315c7240c19894dd8be4f < 35151e9a8274174ccbb92e3b3ba7dc7a008dcada","Linux >= 5f03a507b29e44a848f315c7240c19894dd8be4f < cd6e11b6ebe04a0a1f1435df561acada9eadc563","Linux >= 5f03a507b29e44a848f315c7240c19894dd8be4f < f7eae6d8d768fabd6b59779ca7da79e02c74e113","Linux 6.8"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T15:17:27.102Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98512","references":[{"url":"https://git.kernel.org/stable/c/40edf5eefc3fd94592a91d6eb074d4fc6f606c75"},{"url":"https://git.kernel.org/stable/c/35151e9a8274174ccbb92e3b3ba7dc7a008dcada"},{"url":"https://git.kernel.org/stable/c/cd6e11b6ebe04a0a1f1435df561acada9eadc563"},{"url":"https://git.kernel.org/stable/c/f7eae6d8d768fabd6b59779ca7da79e02c74e113"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T15:45:12.286Z","slug":"CVE-2026-98512","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: RCU-free the scheduler-containing nouveau_sched\n\nstruct nouveau_sched embeds a struct drm_gpu_scheduler (base).\nnouveau_sched_destroy() calls nouveau_sched_fini() (which does\ndrm_sched_fini(&sched->base)) and then frees the object with plain\nkfree(sched).\n\ndrm_sched_fence_get_timeline_name() returns fence->sched->name, and the\nscheduler fence keeps a .release callback so it is not ops-detached on\nsignalling.  A finished fence exported to userspace via drm_syncobj /\nsync_file therefore keeps pointing at &sched->base after nouveau_sched_destroy(),\nand a later get_timeline_name() -- reachable unprivileged through\nSYNC_IOC_FILE_INFO -- dereferences freed memory (KASAN slab-use-after-free\nread).\n\nPer the dma-fence lifetime contract the exporter must keep the data backing a\nsignalled fence alive for an RCU grace period.  Free the scheduler-containing\nobject with kfree_rcu() instead of kfree().\n\n## Affected\n\n- `Linux >= 5f03a507b29e44a848f315c7240c19894dd8be4f < 40edf5eefc3fd94592a91d6eb074d4fc6f606c75`\n- `Linux >= 5f03a507b29e44a848f315c7240c19894dd8be4f < 35151e9a8274174ccbb92e3b3ba7dc7a008dcada`\n- `Linux >= 5f03a507b29e44a848f315c7240c19894dd8be4f < cd6e11b6ebe04a0a1f1435df561acada9eadc563`\n- `Linux >= 5f03a507b29e44a848f315c7240c19894dd8be4f < f7eae6d8d768fabd6b59779ca7da79e02c74e113`\n- `Linux 6.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}