CVE-2026-98512drm/nouveau: RCU-free the scheduler-containing nouveau_sched
- 7.1HighCVSS base score
- 0.16%Exploitation in 30 daysEPSS · top 95% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: RCU-free the scheduler-containing nouveau_sched struct nouveau_sched embeds a struct drm_gpu_scheduler (base). nouveau_sched_destroy() calls nouveau_sched_fini() (which does drm_sched_fini(&sched->base)) and then frees the object with plain kfree(sched). drm_sched_fence_get_timeline_name() returns fence->sched->name, and the scheduler fence keeps a .release callback so it is not ops-detached on signalling. A finished fence exported to userspace via drm_syncobj / sync_file therefore keeps pointing at &sched->base after nouveau_sched_destroy(), and a later get_timeline_name() -- reachable unprivileged through SYNC_IOC_FILE_INFO -- dereferences freed memory (KASAN slab-use-after-free read). Per the dma-fence lifetime contract the exporter must keep the data backing a signalled fence alive for an RCU grace period. Free the scheduler-containing object with kfree_rcu() instead of kfree().
Timeline
ID reserved
By Linux
- 23 days later
· 23 days later
Published
- 6 days later
· 6 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
| NVDNVD · Received | 3.1 | High7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.16% · top 95% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.
Affected products
- affected 5f03a507b29e44a848f315c7240c19894dd8be4f – < 40edf5eefc3fd94592a91d6eb074d4fc6f606c75
- affected 5f03a507b29e44a848f315c7240c19894dd8be4f – < 35151e9a8274174ccbb92e3b3ba7dc7a008dcada
- affected 5f03a507b29e44a848f315c7240c19894dd8be4f – < cd6e11b6ebe04a0a1f1435df561acada9eadc563
- affected 5f03a507b29e44a848f315c7240c19894dd8be4f – < f7eae6d8d768fabd6b59779ca7da79e02c74e113
- affected 6.8
- unaffected < 6.8
- unaffected 6.12.112 – ≤ 6.12.*
- unaffected 6.18.55 – ≤ 6.18.*
- unaffected 7.2.9 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References4
- https://git.kernel.org/stable/c/40edf5eefc3fd94592a91d6eb074d4fc6f606c75 (opens in a new tab)
- https://git.kernel.org/stable/c/35151e9a8274174ccbb92e3b3ba7dc7a008dcada (opens in a new tab)
- https://git.kernel.org/stable/c/cd6e11b6ebe04a0a1f1435df561acada9eadc563 (opens in a new tab)
- https://git.kernel.org/stable/c/f7eae6d8d768fabd6b59779ca7da79e02c74e113 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-103752 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-98512)Record last updated .