From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7B23E37A820 for ; Sun, 18 Oct 2026 15:24:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792337081; cv=none; b=LvUOE/bBShUmXoL+X83cAFO0G8+OF4PkdOcV9oD/eM9dTIh0DTPjDw7RSCY7q6oGk0JxKT6CB/GZAtK41xEJxttm9a4EBeH/ks9UAShN9DIVCPAt4StbZegrEfzXEgTECcCrTpNs32DWf3IgH79Th0um0VBj0KQH2AYqnhjTZdw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792337081; c=relaxed/simple; bh=IGXe+TSiF2INm2lvNcsgE1XNg3Q3WuN2OoBOgMjG3nU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=lCZZ0jp4tz40uIOVnWN/vBSBy9YAhLQ+Vleh9s78fRWXjA5s09fwTMm6rgfkp0BDG4/cKbbBSS3eWIVlSRB2QBKYF8UNPZyi9kBIoOg3bbNQBK7hD7uNz/c3zzhah+E4jAjzGd/RL4KT9u17TlWcyIu4aRXUqShEHyY3cUsAr4I= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=mvue8sPn; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="mvue8sPn" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7675B1F000C4; Sun, 18 Oct 2026 15:24:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792337076; bh=o8my8boIDoLV+7bsfK3dRdggo5I+IkRov+OuRnJMUmE=; h=From:To:Cc:Subject:Date:Reply-To; b=mvue8sPnIXprS8HVuj2EYhIq2mzwqocMrS3fVG8iJYdetvaARAIghcQXBx9xVBFni 4PhwEnEoQLJcUX0HNAS/hEtEb9aJP8bcOBUgQhp4jTr/21kfo29g/xdiS08IkOcqrB n8/W/dRvKKIIPoXYJkRPhDlCvNasBH30CCUwAMqU= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-98511: drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() Date: Sun, 18 Oct 2026 17:16:15 +0200 Message-ID: <2026101820-CVE-2026-98511-aa3c@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=8413; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=dYo/6VHd+rOVbTvEWO4qrTFvZWvxlvwnnpQYesqtmhA=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlXHnU8a1k+M76W5dQ0nSBPScFr21XKG36/YCoTmPt5k yjffAv2jlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZjIzwMMcwVuLH9dvEdkr6/L 9hl69muaVvld384wv9BSOGF5uyRz8sZtihsfX7zz7vC3hwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() nouveau_bo_pin_locked() checks whether an already pinned BO is in a memory domain compatible with a new pin request. When the domains are incompatible, it sets -EBUSY but still calls ttm_bo_pin() before returning. Callers treat a failed nouveau_bo_pin() as not having acquired a new pin, so the extra pin count is never decreased by a matching unpin. This triggers the warning in ttm_bo_release(): WARN_ON_ONCE(bo->pin_count); Found when fuzzing the nouveau driver with a modified Syzkaller: WARNING: drivers/gpu/drm/ttm/ttm_bo.c:256 at ttm_bo_release+0x827/0x9e0 drivers/gpu/drm/ttm/ttm_bo.c:256, CPU#1: syz.3.24/2212 Modules linked in: CPU: 1 UID: 0 PID: 2212 Comm: syz.3.24 Not tainted 7.2.0 #24 PREEMPT(lazy) nouveau 0000:01:00.0: gsp:msg fn:103 len:0x40/0x20 res:0x19 resp:0x19 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:ttm_bo_release+0x827/0x9e0 drivers/gpu/drm/ttm/ttm_bo.c:256 Code: 02 00 0f 85 51 01 00 00 48 8b 7b 08 e8 d2 20 01 00 e9 80 fd ff ff e8 d8 15 c0 fe 90 0f 0b 90 e9 e1 f8 ff ff e8 ca 15 c0 fe 90 <0f> 0b 90 e9 a4 f8 ff ff e8 bc 15 c0 fe be 03 00 00 00 4c 89 e7 e8 msg: 00000000: 05 00 d0 c1 04 00 f0 f1 01 30 00 00 2d 90 00 00 .........0..-... RSP: 0018:ffffc9000f5cf710 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff888018e5d2a8 RCX: ffffffff82bb1b36 RDX: ffff888017b68000 RSI: 0000000000000004 RDI: ffff888018e5d2a8 msg: 00000010: 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ RBP: ffff88801261c720 R08: 0000000000000001 R09: ffffed10031cba55 R10: ffff888018e5d2ab R11: 00000000000000f3 R12: ffff888018e5d290 R13: ffff888018e5d2d4 R14: ffff88801b219c18 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880e0f6f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b31223ffc CR3: 0000000028e00005 CR4: 0000000000770ef0 PKRU: 80000000 Call Trace: kref_put include/linux/kref.h:65 [inline] ttm_bo_put drivers/gpu/drm/ttm/ttm_bo.c:325 [inline] ttm_bo_fini+0x55/0x80 drivers/gpu/drm/ttm/ttm_bo.c:330 nouveau_gem_object_del+0xb2/0x1b0 drivers/gpu/drm/nouveau/nouveau_gem.c:90 drm_gem_object_free+0x5f/0x90 drivers/gpu/drm/drm_gem.c:1165 kref_put include/linux/kref.h:65 [inline] __drm_gem_object_put include/drm/drm_gem.h:562 [inline] drm_gem_object_put include/drm/drm_gem.h:575 [inline] nouveau_abi16_chan_fini.constprop.0+0x44f/0x5a0 drivers/gpu/drm/nouveau/nouveau_abi16.c:195 nouveau 0000:01:00.0: syz.2.23[2209]: Unknown handle 0x00000000 nouveau_abi16_fini+0x1d0/0x340 drivers/gpu/drm/nouveau/nouveau_abi16.c:225 nouveau_drm_postclose+0x18b/0x3e0 drivers/gpu/drm/nouveau/nouveau_drm.c:1284 nouveau 0000:01:00.0: syz.2.23[2209]: validate_init drm_file_free.part.0+0x6d6/0xb60 drivers/gpu/drm/drm_file.c:267 drm_file_free drivers/gpu/drm/drm_file.c:237 [inline] drm_close_helper.isra.0+0x11a/0x160 drivers/gpu/drm/drm_file.c:290 drm_release+0x1ab/0x330 drivers/gpu/drm/drm_file.c:438 __fput+0x39c/0xa60 fs/file_table.c:512 nouveau 0000:01:00.0: syz.2.23[2209]: validate: -2 task_work_run+0x15a/0x230 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x82b/0x25a0 kernel/exit.c:1009 do_group_exit+0xc2/0x280 kernel/exit.c:1152 get_signal+0x1d6e/0x1f30 kernel/signal.c:3046 arch_do_signal_or_restart+0x7d/0x6e0 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0xdf/0x440 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline] do_syscall_64+0x4f8/0x690 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f12bac8594d Code: Unable to access opcode bytes at 0x7f12bac85923. RSP: 002b:00007f12b96e70d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: 0000000000000001 RBX: 00007f12baf15fa8 RCX: 00007f12bac8594d RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f12baf15fac RBP: 00007f12baf15fa0 R08: 00007f12baee8000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f12baf16038 R14: 0000000000000006 R15: 00007ffe2ed394b0 irq event stamp: 47867 hardirqs last enabled at (47883): [] __up_console_sem+0x66/0x70 kernel/printk/printk.c:347 hardirqs last disabled at (47892): [] __up_console_sem+0x4b/0x70 kernel/printk/printk.c:345 softirqs last enabled at (47880): [] __do_softirq kernel/softirq.c:656 [inline] softirqs last enabled at (47880): [] invoke_softirq kernel/softirq.c:496 [inline] softirqs last enabled at (47880): [] __irq_exit_rcu+0x137/0x1c0 kernel/softirq.c:735 softirqs last disabled at (47875): [] __do_softirq kernel/softirq.c:656 [inline] softirqs last disabled at (47875): [] invoke_softirq kernel/softirq.c:496 [inline] softirqs last disabled at (47875): [] __irq_exit_rcu+0x137/0x1c0 kernel/softirq.c:735 Fix by calling ttm_bo_pin() only when the existing placement is compatible with the new pin request. This matches the correct behavior in other DRM drivers such as amdgpu_bo_pin() in amdgpu. The Linux kernel CVE team has assigned CVE-2026-98511 to this issue. Affected and fixed versions =========================== Issue introduced in 3.19 with commit ad76b3f7c7a0836e74ac0e316e03988ef3c43564 and fixed in 5.15.222 with commit a6e755acf85793a7b4d29ba27b5421af1087263f Issue introduced in 3.19 with commit ad76b3f7c7a0836e74ac0e316e03988ef3c43564 and fixed in 6.1.189 with commit 5cb7109f0f5f1b47b172e2d5b868d4ce3ae687f8 Issue introduced in 3.19 with commit ad76b3f7c7a0836e74ac0e316e03988ef3c43564 and fixed in 6.6.158 with commit 9924c1d64405be8d10b906368dfb1cfe0d0c6bf0 Issue introduced in 3.19 with commit ad76b3f7c7a0836e74ac0e316e03988ef3c43564 and fixed in 6.12.112 with commit 73c7093e6cc1e6b181a79e16eccc4b8d4f34d8ee Issue introduced in 3.19 with commit ad76b3f7c7a0836e74ac0e316e03988ef3c43564 and fixed in 6.18.55 with commit 19f5a5839b308697824ff46e6213a2b4cb677771 Issue introduced in 3.19 with commit ad76b3f7c7a0836e74ac0e316e03988ef3c43564 and fixed in 7.2.9 with commit 189ffc7b6cad6390c0695031cb6c7c63472981e8 Issue introduced in 3.19 with commit ad76b3f7c7a0836e74ac0e316e03988ef3c43564 and fixed in 7.3-rc5 with commit 6a6870d3077faa501ca97760057ddca22b68418d Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-98511 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/gpu/drm/nouveau/nouveau_bo.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/a6e755acf85793a7b4d29ba27b5421af1087263f https://git.kernel.org/stable/c/5cb7109f0f5f1b47b172e2d5b868d4ce3ae687f8 https://git.kernel.org/stable/c/9924c1d64405be8d10b906368dfb1cfe0d0c6bf0 https://git.kernel.org/stable/c/73c7093e6cc1e6b181a79e16eccc4b8d4f34d8ee https://git.kernel.org/stable/c/19f5a5839b308697824ff46e6213a2b4cb677771 https://git.kernel.org/stable/c/189ffc7b6cad6390c0695031cb6c7c63472981e8 https://git.kernel.org/stable/c/6a6870d3077faa501ca97760057ddca22b68418d