---
id: CVE-2026-89802
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op

  Each bind_job_op is zeroed by kzalloc_obj() in bind_job_op_from_uop(),
  and the OP_MAP_SPARSE case in nou…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op

  Each bind_job_op is zeroed by kzalloc_obj() in bind_job_op_from_uop(),
  and the OP_MAP_SPARSE case in nou…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b88baab828713ce0b49b185444b2ee83bed373a8 <
    3bf493cf7ed0c2b3df728977a257e0d99b4db1c6
  - >-
    Linux >= b88baab828713ce0b49b185444b2ee83bed373a8 <
    b7dc03e09313d22a6d230b759de3b05d504c008f
  - >-
    Linux >= b88baab828713ce0b49b185444b2ee83bed373a8 <
    3857238de6bce6c1573e8cb86c37b067e5208f05
  - >-
    Linux >= b88baab828713ce0b49b185444b2ee83bed373a8 <
    412a6ceb56d501ef2f8202e26ab4b5d4dfbca566
  - Linux 6.6
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T11:16:45.113'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89802'
references:
  - url: 'https://git.kernel.org/stable/c/3857238de6bce6c1573e8cb86c37b067e5208f05'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3bf493cf7ed0c2b3df728977a257e0d99b4db1c6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/412a6ceb56d501ef2f8202e26ab4b5d4dfbca566'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b7dc03e09313d22a6d230b759de3b05d504c008f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T10:53:54.009Z'
epss: 0.002
epssPercentile: 0.10114
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op

Each bind_job_op is zeroed by kzalloc_obj() in bind_job_op_from_uop(),
and the OP_MAP_SPARSE case in nouveau_uvmm_bind_job_submit() only creates
a region, so op->ops stays NULL for a successfully processed sparse map.

If a later op in the same job fails, the reverse unwind loop revisits that
op and calls drm_gpuva_ops_free(&uvmm->base, op->ops) unconditionally.
drm_gpuva_ops_free() dereferences its argument right away
(list_for_each_entry_safe on &ops->list), so a NULL op->ops oopses. The
path is reachable by any render-node fd holder, since NOUVEAU_VM_BIND is
DRM_RENDER_ALLOW.

Guard the free with IS_ERR_OR_NULL(), as nouveau_uvmm_bind_job_cleanup()
already does for the identical free.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.