{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89804", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.767Z", "datePublished": "2026-09-16T10:30:37.638Z", "dateUpdated": "2026-09-16T14:38:49.967Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-16T14:38:49.967Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/dmem: fix mismatched DMA unmap size for large folios\n\nDevice-private THP migration maps migration buffers with page_size()\nand records that length in dma_info->size. For a compound folio\npage_size() is PAGE_SIZE << order, but two teardown sites still pass a\nliteral PAGE_SIZE to dma_unmap_page():\n\n - nouveau_dmem_migrate_to_ram() on the success path, and\n - nouveau_dmem_migrate_copy_one() on the copy-error path.\n\nFor an order > 0 folio this unmaps less than was mapped, leaking the\nremainder of the IOMMU/IOVA mapping. The other unmap sites, in\nnouveau_dmem_migrate_chunk() and nouveau_dmem_evict_chunk(), already\nuse the saved size; use it here too."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - An unprivileged local process reaches the bug via DRM render-node ioctls DRM_IOCTL_NOUVEAU_SVM_INIT and DRM_IOCTL_NOUVEAU_SVM_BIND (DRM_RENDER_ALLOW), then a CPU fault on the migrated device-private THP in nouveau_dmem_migrate_to_ram(). There is no network, Bluetooth, or USB packet path.\nAC:L - The attacker fully controls the sequence: mmap a THP (MADV_HUGEPAGE), SVM_BIND migrate to GPU VRAM, then load/store that range to force migrate_to_ram. For order>0 folios the success path always dma_map_page(page_size()) then dma_unmap_page(PAGE_SIZE); no race or uninfluenced layout is required.\nPR:L - NOUVEAU_SVM_INIT and NOUVEAU_SVM_BIND are DRM_RENDER_ALLOW with no capable() or DRM-master check. An ordinary local user with typical render/video-group access to /dev/dri/renderD* on a Pascal nouveau system can open the render node and issue the ioctls without init-namespace root.\nUI:N - The attacker opens the render node, initializes SVM, migrates their own anonymous THP to VRAM, and faults it back entirely in their process. No separate victim action such as mounting a filesystem or opening a crafted file is required.\nS:C - dma_unmap_page(PAGE_SIZE) after a compound-folio dma_map_page() leaves leftover IOMMU PTEs and returns only the start IOVA to the rcache while the original 2MB IOVA node remains. A later rcache flush can free that whole range with stale PTEs still aimed at recycled host pages, which is an IOMMU/DMA isolation bypass.\nC:H - Stale IOMMU mappings keep the GPU able to DMA-read physical pages after the destination folio is freed and reused by the kernel or other processes. Combined with IOVA double-allocation of the start pfn, that is an arbitrary physical-memory read, not a bounded kernel-pointer leak.\nI:H - The same leftover PTEs and overlapping IOVA reuse let the NVIDIA copy engine DMA-write into recycled pages (kernel objects, other processes, or later DMA buffers). That is an arbitrary physical write through the IOMMU, exploitable for control-flow hijack, not a limited integrity change.\nA:H - Repeated THP migrate/fault cycles leak IOVA until GPU DMA fails, and DMA into recycled pages or IOVA allocator corruption (rcache flush dropping the whole 2MB node while PTEs linger) causes kernel oops, panic, or hang, not mere performance degradation."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/nouveau/nouveau_dmem.c"], "versions": [{"version": "c3228747107705d47c7e9a03598a434a0380cb73", "lessThan": "4deb29b9d33bfdb3de4d2d9944947ecf77221e42", "status": "affected", "versionType": "git"}, {"version": "c3228747107705d47c7e9a03598a434a0380cb73", "lessThan": "caa1bc2a0a6ca19dcb90bbf88208b0fe2decd66f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/nouveau/nouveau_dmem.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.5", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.2.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.3-rc2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4deb29b9d33bfdb3de4d2d9944947ecf77221e42"}, {"url": "https://git.kernel.org/stable/c/caa1bc2a0a6ca19dcb90bbf88208b0fe2decd66f"}], "title": "drm/nouveau/dmem: fix mismatched DMA unmap size for large folios", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/nouveau/nouveau_dmem.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "4deb29b9d33bfdb3de4d2d9944947ecf77221e42", "status": "affected", "version": "c3228747107705d47c7e9a03598a434a0380cb73", "versionType": "git"}, {"lessThan": "caa1bc2a0a6ca19dcb90bbf88208b0fe2decd66f", "status": "affected", "version": "c3228747107705d47c7e9a03598a434a0380cb73", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/nouveau/nouveau_dmem.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/dmem: fix mismatched DMA unmap size for large folios\n\nDevice-private THP migration maps migration buffers with page_size()\nand records that length in dma_info->size. For a compound folio\npage_size() is PAGE_SIZE << order, but two teardown sites still pass a\nliteral PAGE_SIZE to dma_unmap_page():\n\n - nouveau_dmem_migrate_to_ram() on the success path, and\n - nouveau_dmem_migrate_copy_one() on the copy-error path.\n\nFor an order > 0 folio this unmaps less than was mapped, leaking the\nremainder of the IOMMU/IOVA mapping. The other unmap sites, in\nnouveau_dmem_migrate_chunk() and nouveau_dmem_evict_chunk(), already\nuse the saved size; use it here too."}], "id": "CVE-2026-89804", "lastModified": "2026-09-16T15:18:10.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-16T11:16:45.347", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4deb29b9d33bfdb3de4d2d9944947ecf77221e42"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/caa1bc2a0a6ca19dcb90bbf88208b0fe2decd66f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{}