---
id: CVE-2026-98514
title: 'drm/nouveau: Fix gem reference leak in validate_init()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/nouveau: Fix gem reference leak in validate_init()

  On the ttm_bo_reserve() failure and "vma not found" error paths, the
  loop breaks without adding the looked-up ob…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 19ca10d82e33bcfe92412c461fc3534ec1e14747 <
    af2f48c12365866abb327d75c21a13bbde84719c
  - >-
    Linux >= 19ca10d82e33bcfe92412c461fc3534ec1e14747 <
    3c80e069470cf73c357c9edb5ec5fba20e6f6a98
  - >-
    Linux >= 19ca10d82e33bcfe92412c461fc3534ec1e14747 <
    957619120c26d6727efd18504e6b488673d3900a
  - >-
    Linux >= 19ca10d82e33bcfe92412c461fc3534ec1e14747 <
    74485cdc343060fce08f8f3990da524d783e43a7
  - >-
    Linux >= 19ca10d82e33bcfe92412c461fc3534ec1e14747 <
    8281930fc194ad448aaa5de8dd47fb6fb1cba327
  - >-
    Linux >= 19ca10d82e33bcfe92412c461fc3534ec1e14747 <
    030e93fc91d55d9487b3b85fc0712bb795d77834
  - >-
    Linux >= 19ca10d82e33bcfe92412c461fc3534ec1e14747 <
    9e13c398a23445baf38f0a59033dd9872a2bfe20
  - >-
    Linux >= 19ca10d82e33bcfe92412c461fc3534ec1e14747 <
    5ea72f7b7139b123713a7983448f910bc4514d9e
  - Linux bcc16811023394a5e61a20c107f1fa560a28b7c1
  - Linux >= 4.17.12 < 4.18
  - Linux 4.18
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:17:30.612Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98514'
references:
  - url: 'https://git.kernel.org/stable/c/af2f48c12365866abb327d75c21a13bbde84719c'
  - url: 'https://git.kernel.org/stable/c/3c80e069470cf73c357c9edb5ec5fba20e6f6a98'
  - url: 'https://git.kernel.org/stable/c/957619120c26d6727efd18504e6b488673d3900a'
  - url: 'https://git.kernel.org/stable/c/74485cdc343060fce08f8f3990da524d783e43a7'
  - url: 'https://git.kernel.org/stable/c/8281930fc194ad448aaa5de8dd47fb6fb1cba327'
  - url: 'https://git.kernel.org/stable/c/030e93fc91d55d9487b3b85fc0712bb795d77834'
  - url: 'https://git.kernel.org/stable/c/9e13c398a23445baf38f0a59033dd9872a2bfe20'
  - url: 'https://git.kernel.org/stable/c/5ea72f7b7139b123713a7983448f910bc4514d9e'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.289Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: Fix gem reference leak in validate_init()

On the ttm_bo_reserve() failure and "vma not found" error paths, the
loop breaks without adding the looked-up object to any validate list,
so the reference taken by drm_gem_object_lookup() is never released;
validate_fini() only walks the spliced lists.  Drop the reference
before breaking out on both paths.

## Affected

- `Linux >= 19ca10d82e33bcfe92412c461fc3534ec1e14747 < af2f48c12365866abb327d75c21a13bbde84719c`
- `Linux >= 19ca10d82e33bcfe92412c461fc3534ec1e14747 < 3c80e069470cf73c357c9edb5ec5fba20e6f6a98`
- `Linux >= 19ca10d82e33bcfe92412c461fc3534ec1e14747 < 957619120c26d6727efd18504e6b488673d3900a`
- `Linux >= 19ca10d82e33bcfe92412c461fc3534ec1e14747 < 74485cdc343060fce08f8f3990da524d783e43a7`
- `Linux >= 19ca10d82e33bcfe92412c461fc3534ec1e14747 < 8281930fc194ad448aaa5de8dd47fb6fb1cba327`
- `Linux >= 19ca10d82e33bcfe92412c461fc3534ec1e14747 < 030e93fc91d55d9487b3b85fc0712bb795d77834`
- `Linux >= 19ca10d82e33bcfe92412c461fc3534ec1e14747 < 9e13c398a23445baf38f0a59033dd9872a2bfe20`
- `Linux >= 19ca10d82e33bcfe92412c461fc3534ec1e14747 < 5ea72f7b7139b123713a7983448f910bc4514d9e`
- `Linux bcc16811023394a5e61a20c107f1fa560a28b7c1`
- `Linux >= 4.17.12 < 4.18`
- `Linux 4.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.