CVE-2026-89553

HighCVSS 7.8/10Last modified Oct 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nouveau/gem: reserve the bo in the info ioctl around the vma lookup

In the non-uvmm path, there could be a race between the info lookup finding the vma, and the gem close path closing the vma leading to a use-after-free.

Spotted with the help of Opus 4.6.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= e758a3111914af7ee4351be86f1ac0efe87ed06e, < 3e9c9090d4cc5a61ab5067ac5502c4fd37891b97; >= e758a3111914af7ee4351be86f1ac0efe87ed06e, < 24340ab41c33e16b3d64d89cb738ecd83c78de49; >= e758a3111914af7ee4351be86f1ac0efe87ed06e, < f57e0d3bee3f7a459c048e10fd1cbcfd1dac2e0f; >= e758a3111914af7ee4351be86f1ac0efe87ed06e, < e05c28bd6043d0fd0bea9c3fc49300a8871a1a81; >= e758a3111914af7ee4351be86f1ac0efe87ed06e, < 208867763843aa82efcbe3b771f1b8e6c7aa820a; >= e758a3111914af7ee4351be86f1ac0efe87ed06e, < ff110e85837d7ecd83f36078107be240ff5ae409; >= e758a3111914af7ee4351be86f1ac0efe87ed06e, < e60466011ac3a6b8045e6cc3c2cbb30d58039d2e; >= e758a3111914af7ee4351be86f1ac0efe87ed06e, < 5e17160d41d92823f3379c1982e1369680c5ce4d
LinuxLinux3.1

References

Timeline

Published
Sep 11, 2026
Last modified
Oct 30, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-895548.2In the Linux kernel, the following vulnerability has been resolved: mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction CVE-2026-895559.8In the Linux kernel, the following vulnerability has been resolved: mpls: reload header after pskb_may_pull() mpls_select_multipath() callCVE-2026-89556In the Linux kernel, the following vulnerability has been resolved: module: validate string table section types In elf_validity_cache_sechCVE-2026-895577.8In the Linux kernel, the following vulnerability has been resolved: md: do overflow check for sb->bblog_shift in super_1_load() In super_1CVE-2026-895589.8In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix still_degraded being inverted in raid10_sync_request() CVE-2026-895597.8In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in __nd_label_validate() ThCVE-2026-89569.8Integer overflow in the Networking: JAR component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and ThuCVE-2026-895608.4In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation WhCVE-2026-895617.5In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() ipv6_rplCVE-2026-895627.8In the Linux kernel, the following vulnerability has been resolved: ip6_gre: fix hardware header length for NBMA tunnels ip6gre_tnl_link_cCVE-2026-895637.8In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() ip6_tnl_xmit() may neCVE-2026-895647.8In the Linux kernel, the following vulnerability has been resolved: ip: orphan prefetched skbs before multicast forwarding IPv4 and IPv6 i
CVE-2026-89553: High severity, CVSS 7.8 | Vulnix