Answer in brief
CVE-2026-98514 records a Unknown severity vulnerability in drm/nouveau: Fix gem reference leak in validate_init(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=19ca10d82e33bcfe92412c461fc3534ec1e14747 <af2f48c12365866abb327d75c21a13bbde84719c || >=19ca10d82e33bcfe92412c461fc3534ec1e14747 <3c80e069470cf73c357c9edb5ec5fba20e6f6a98 || >=19ca10d82e33bcfe92412c461fc3534ec1e14747 <957619120c26d6727efd18504e6b488673d3900a || >=19ca10d82e33bcfe92412c461fc3534ec1e14747 <74485cdc343060fce08f8f3990da524d783e43a7 || >=19ca10d82e33bcfe92412c461fc3534ec1e14747 <8281930fc194ad448aaa5de8dd47fb6fb1cba327 || >=19ca10d82e33bcfe92412c461fc3534ec1e14747 <030e93fc91d55d9487b3b85fc0712bb795d77834 || >=19ca10d82e33bcfe92412c461fc3534ec1e14747 <9e13c398a23445baf38f0a59033dd9872a2bfe20 || >=19ca10d82e33bcfe92412c461fc3534ec1e14747 <5ea72f7b7139b123713a7983448f910bc4514d9e || bcc16811023394a5e61a20c107f1fa560a28b7c1 || >=4.17.12 <4.18 | af2f48c12365866abb327d75c21a13bbde84719c, 3c80e069470cf73c357c9edb5ec5fba20e6f6a98, 957619120c26d6727efd18504e6b488673d3900a, 74485cdc343060fce08f8f3990da524d783e43a7, 8281930fc194ad448aaa5de8dd47fb6fb1cba327, 030e93fc91d55d9487b3b85fc0712bb795d77834, 9e13c398a23445baf38f0a59033dd9872a2bfe20, 5ea72f7b7139b123713a7983448f910bc4514d9e, 4.18 |
| Linux/Linuxgeneric | 4.18 | Not reported |
Published upstream
Oct 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 18, 2026
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validate_init() On the ttm_bo_reserve() failure and "vma not found" error paths, the loop breaks without adding the looked-up object to any validate list, so the reference taken by drm_gem_object_lookup() is never released; validate_fini() only walks the spliced lists. Drop the reference before breaking out on both paths.
Quoted source text, attributed separately from HOL analysis.