Answer in brief
CVE-2026-89801 records a High severity (CVSS 7.8) vulnerability in drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=b88baab828713ce0b49b185444b2ee83bed373a8 <ba42d8a1c2c7629c61914df11a7d63ac77449ffb || >=b88baab828713ce0b49b185444b2ee83bed373a8 <88114e3a96582882e63b2f73aa7a5a9cf0d5073c || >=b88baab828713ce0b49b185444b2ee83bed373a8 <24c25b182d17d1bdfde0088c96bdf6f93e8f46bc || >=b88baab828713ce0b49b185444b2ee83bed373a8 <4083d24c2636fde7b18076115af52820d203bc57 || >=b88baab828713ce0b49b185444b2ee83bed373a8 <ccf930812f23b8259ef64fd3394d53b093e4651a | ba42d8a1c2c7629c61914df11a7d63ac77449ffb, 88114e3a96582882e63b2f73aa7a5a9cf0d5073c, 24c25b182d17d1bdfde0088c96bdf6f93e8f46bc, 4083d24c2636fde7b18076115af52820d203bc57, ccf930812f23b8259ef64fd3394d53b093e4651a |
| Linux/Linuxgeneric | 6.6 | Not reported |
Published upstream
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 16, 2026
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE In nouveau_uvmm_bind_job_submit()'s OP_UNMAP_SPARSE arm, op->reg is set from nouveau_uvma_region_find(), which only looks the region up and takes no reference; a region's sole reference is its membership in uvmm->region_mt. Two failure paths leave op->reg set: the -ENOENT check when the region is busy, and the drm_gpuvm_sm_unmap_ops_create() failure. The sibling nouveau_uvmm_sm_unmap_prepare() failure just below clears op->reg; these two do not. unwind_continue steps back one op, so the failing op is skipped by the unwind loop and its op->reg stays set. nouveau_uvmm_bind_job_cleanup() then enters its if (op->reg) branch and calls nouveau_uvma_region_remove() and nouveau_uvma_region_put() on it, dropping the tree's sole reference and freeing a region this job never created. The comment above the cleanup loop documents the broken invariant: op->reg must be NULL on submit failure. This frees a live region on an unrelated failure, reachable single-job when drm_gpuvm_sm_unmap_ops_create() returns -ENOMEM; if another job owns the same region, its cleanup then removes and puts the freed region, a use-after-free. Clear op->reg on both failure paths.
Quoted source text, attributed separately from HOL analysis.