In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE
In nouveau_uvmm_bind_job_submit()'s OP_UNMAP_SPARSE arm, op->reg is set
from nouveau_uvma_region_find(), which only looks the region up and takes
no reference; a region's sole reference is its membership in
uvmm->region_mt. Two failure paths leave op->reg set: the -ENOENT check
when the region is busy, and the drm_gpuvm_sm_unmap_ops_create() failure.
The sibling nouveau_uvmm_sm_unmap_prepare() failure just below clears
op->reg; these two do not.
unwind_continue steps back one op, so the failing op is skipped by the
unwind loop and its op->reg stays set. nouveau_uvmm_bind_job_cleanup()
then enters its if (op->reg) branch and calls nouveau_uvma_region_remove()
and nouveau_uvma_region_put() on it, dropping the tree's sole reference
and freeing a region this job never created. The comment above the
cleanup loop documents the broken invariant: op->reg must be NULL on
submit failure.
This frees a live region on an unrelated failure, reachable single-job
when drm_gpuvm_sm_unmap_ops_create() returns -ENOMEM; if another job owns
the same region, its cleanup then removes and puts the freed region, a
use-after-free. Clear op->reg on both failure paths.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.8
AV:L - The bug is reached through DRM_IOCTL_NOUVEAU_VM_BIND on a nouveau render node (/dev/dri/renderD*): nouveau_uvmm_ioctl_vm_bind → nouveau_job_submit → nouveau_uvmm_bind_job_submit. This is a local ioctl path, not a network, adjacent-radio, or physical-bus interface.
AC:L - An attacker can MAP_SPARSE a region, submit an async OP_UNMAP_SPARSE that dirties it while holding op->reg, then a second OP_UNMAP_SPARSE on the same range (or two unmaps in one ioctl). The failing path leaves op->reg set and cleanup frees the live region. The attacker drives both jobs, so no condition is outside their control.
PR:L - NOUVEAU_VM_INIT and NOUVEAU_VM_BIND are DRM_RENDER_ALLOW with no DRM_ROOT_ONLY or capability checks. Any unprivileged local user who can open the nouveau render node (typical render/video group) can trigger this without init-namespace root.
UI:N - The attacker opens their own DRM client and issues VM_INIT/VM_BIND ioctls on that fd; no separate victim action such as mounting a filesystem or opening an attacker-controlled file is required.
S:U - The use-after-free corrupts kernel heap state (struct nouveau_uvma_region) inside the host nouveau driver. Impact stays in the same kernel authority; this is not a VM escape or IOMMU/DMA isolation bypass.
C:H - Cleanup of a failed OP_UNMAP_SPARSE drops the maple-tree's sole reference and kfree()s a live nouveau_uvma_region another job still holds in op->reg. That use-after-free of a kernel object enables disclosure of reused slab contents, so confidentiality is High.
I:H - The owning job's later cleanup calls sparse-unref, mas_erase, complete_all, and kref_put on the already-freed region. Heap spraying can reuse that object to corrupt kernel pointers and hijack control flow, so integrity is High.
A:H - Dereferencing the freed nouveau_uvma_region in nouveau_uvmm_bind_job_cleanup, maple-tree remove, or a later bind causes a kernel oops/panic; the attacker can repeat the sequence to crash or hang the system.
| Attack Vector |
Local |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
Low |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The bug is reached through DRM_IOCTL_NOUVEAU_VM_BIND on a nouveau render node (/dev/dri/renderD*): nouveau_uvmm_ioctl_vm_bind → nouveau_job_submit → nouveau_uvmm_bind_job_submit. This is a local ioctl path, not a network, adjacent-radio, or physical-bus interface.
AC:L - An attacker can MAP_SPARSE a region, submit an async OP_UNMAP_SPARSE that dirties it while holding op->reg, then a second OP_UNMAP_SPARSE on the same range (or two unmaps in one ioctl). The failing path leaves op->reg set and cleanup frees the live region. The attacker drives both jobs, so no condition is outside their control.
PR:L - NOUVEAU_VM_INIT and NOUVEAU_VM_BIND are DRM_RENDER_ALLOW with no DRM_ROOT_ONLY or capability checks. Any unprivileged local user who can open the nouveau render node (typical render/video group) can trigger this without init-namespace root.
UI:N - The attacker opens their own DRM client and issues VM_INIT/VM_BIND ioctls on that fd; no separate victim action such as mounting a filesystem or opening an attacker-controlled file is required.
S:U - The use-after-free corrupts kernel heap state (struct nouveau_uvma_region) inside the host nouveau driver. Impact stays in the same kernel authority; this is not a VM escape or IOMMU/DMA isolation bypass.
C:H - Cleanup of a failed OP_UNMAP_SPARSE drops the maple-tree's sole reference and kfree()s a live nouveau_uvma_region another job still holds in op->reg. That use-after-free of a kernel object enables disclosure of reused slab contents, so confidentiality is High.
I:H - The owning job's later cleanup calls sparse-unref, mas_erase, complete_all, and kref_put on the already-freed region. Heap spraying can reuse that object to corrupt kernel pointers and hijack control flow, so integrity is High.
A:H - Dereferencing the freed nouveau_uvma_region in nouveau_uvmm_bind_job_cleanup, maple-tree remove, or a later bind causes a kernel oops/panic; the attacker can repeat the sequence to crash or hang the system.
CVSS 3.1