CVE-2026-98512 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution vendors, and users of Linux systems with the drm/nouveau component enabled should assess exposure and apply the patch. Additionally, security teams and operators responsible for Linux kernel deployments need to review and verify the patch deployment to prevent potential exploitation.

Why it matters

A use-after-free vulnerability in the Linux kernel's drm/nouveau component can be triggered by an unprivileged user, potentially leading to a slab-use-after-free read vulnerability. Defenders should review and apply the kernel patch, restrict access to the SYNC_IOC_FILE_INFO ioctl, and monitor kernel updates.

• Unprivileged users can trigger the vulnerability through the SYNC_IOC_FILE_INFO ioctl
• Successful exploitation may lead to slab-use-after-free read vulnerability
• Verification of kernel patch deployment is necessary to ensure mitigation
• Exposure requires verification from official kernel sources

Technical summary

The Linux kernel's drm/nouveau component has a use-after-free vulnerability. The nouveau_sched_destroy() function calls nouveau_sched_fini() and then frees the scheduler-containing object with kfree(). However, drm_sched_fence_get_timeline_name() returns fence->sched->name, and the scheduler fence keeps a .release callback, allowing it to be accessed after free. The vulnerability can be triggered by an unprivileged user through the SYNC_IOC_FILE_INFO ioctl, potentially leading to a slab-use-after-free read vulnerability. The issue is mitigated by changing the free operation to kfree_rcu(), ensuring the object remains accessible for an RCU grace period.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the kernel patch that replaces kfree() with kfree_rcu() for the scheduler-containing object
• Restrict access to the SYNC_IOC_FILE_INFO ioctl to prevent unprivileged users from triggering the vulnerability
• Monitor kernel updates and ensure the patched version is deployed
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability was resolved by changing the scheduler-containing object free operation from kfree() to kfree_rcu(). This ensures that the object remains accessible for an RCU grace period after signaled fences have been exported to userspace.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.