drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() nouveau_bo_pin_locked() checks whether an already pinned BO is in a memory domain compatible with a new pin request. When the domains are incompatible, it sets -EBUSY but still calls ttm_bo_pin() before returning. Callers treat a failed nouveau_bo_pin() as not having acquired a new pin, so the extra pin count is never decreased by a matching unpin. This triggers the warning in ttm_bo_release(): WARN_ON_ONCE(bo->pin_count); Found when fuzzing the nouveau driver with a modified Syzkaller: WARNING: drivers/gpu/drm/ttm/ttm_bo.c:256 at ttm_bo_release+0x827/0x9e0 drivers/gpu/drm/ttm/ttm_bo.c:256, CPU#1: syz.3.24/2212 Modules linked in: CPU: 1 UID: 0 PID: 2212 Comm: syz.3.24 Not tainted 7.2.0 #24 PREEMPT(lazy) nouveau 0000:01:00.0: gsp:msg fn:103 len:0x40/0x20 res:0x19 resp:0x19 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:ttm_bo_release+0x827/0x9e0 drivers/gpu/drm/ttm/ttm_bo.c:256 Code: 02 00 0f 85 51 01 00 00 48 8b 7b 08 e8 d2 20 01 00 e9 80 fd ff ff e8 d8 15 c0 fe 90 0f 0b 90 e9 e1 f8 ff ff e8 ca 15 c0 fe 90 <0f> 0b 90 e9 a4 f8 ff ff e8 bc 15 c0 fe be 03 00 00 00 4c 89 e7 e8 msg: 00000000: 05 00 d0 c1 04 00 f0 f1 01 30 00 00 2d 90 00 00 .........0..-... RSP: 0018:ffffc9000f5cf710 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff888018e5d2a8 RCX: ffffffff82bb1b36 RDX: ffff888017b6800
CVE-2026-98511
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-98511
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "ad76b3f7c7a0836e74ac0e316e03988ef3c43564",
"lessThan": "a6e755acf85793a7b4d29ba27b5421af1087263f",
"versionType": "git"
},
{
"status": "affected",
"version": "ad76b3f7c7a0836e74ac0e316e03988ef3c43564",
"lessThan": "5cb7109f0f5f1b47b172e2d5b868d4ce3ae687f8",
"versionType": "git"
},
{
"status": "affected",
"version": "ad76b3f7c7a0836e74ac0e316e03988ef3c43564",
"lessThan": "9924c1d64405be8d10b906368dfb1cfe0d0c6bf0",
"versionType": "git"
},
{
"status": "affected",
"version": "ad76b3f7c7a0836e74ac0e316e03988ef3c43564",
"lessThan": "73c7093e6cc1e6b181a79e16eccc4b8d4f34d8ee",
"versionType": "git"
},
{
"status": "affected",
"version": "ad76b3f7c7a0836e74ac0e316e03988ef3c43564",
"lessThan": "19f5a5839b308697824ff46e6213a2b4cb677771",
"versionType": "git"
},
{
"status": "affected",
"version": "ad76b3f7c7a0836e74ac0e316e03988ef3c43564",
"lessThan": "189ffc7b6cad6390c0695031cb6c7c63472981e8",
"versionType": "git"
},
{
"status": "affected",
"version": "ad76b3f7c7a0836e74ac0e316e03988ef3c43564",
"lessThan": "6a6870d3077faa501ca97760057ddca22b68418d",
"versionType": "git"
}
],
"programFiles": [
"drivers/gpu/drm/nouveau/nouveau_bo.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.19"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.19",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/gpu/drm/nouveau/nouveau_bo.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-98511
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #38543 · Revision 1
- Added to Heist Feed
- Publisher date