CVE-2026-89802
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op Each bind_job_op is zeroed by kzalloc_obj() in bind_job_op_from_uop(), and the OP_MAP_SPARSE case in nouveau_uvmm_bind_job_submit() only creates a region, so op->ops stays NULL for a successfully processed sparse map. If a later op in the same job fails, the reverse unwind loop revisits that op and calls drm_gpuva_ops_free(&uvmm->base, op->ops) unconditionally. drm_gpuva_ops_free() dereferences its argument right away (list_for_each_entry_safe on &ops->list), so a NULL op->ops oopses. The path is reachable by any render-node fd holder, since NOUVEAU_VM_BIND is DRM_RENDER_ALLOW. Guard the free with IS_ERR_OR_NULL(), as nouveau_uvmm_bind_job_cleanup() already does for the identical free.
Affected versions
Linux kernel versions
6.6
and later are affected. Fixed in
6.12.110,
6.18.51,
7.2.5,
7.3-rc2
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-89802?
CVE-2026-89802 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.6 onward and has been patched in 6.12.110, 6.18.51, 7.2.5 and others. CVE-2026-89802 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-89802?
Yes. CVE-2026-89802 has been patched. Fixed versions include 6.12.110, 6.18.51, 7.2.5 and others. If you are running Linux kernel 6.6 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-89802 actively exploited?
No. CVE-2026-89802 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.