CVE-2026-46006 drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
A u32 integer overflow in the nouveau GPU driver allows bypassing bounds checks, potentially leading to memory corruption and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46006?
CVE-2026-46006 is a high-severity vulnerability in Linux kernel, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
nouveau_gem_pushbuf_reloc_apply() validates each relocation with
if (r->reloc_bo_offset + 4 > nvbo->bo.base.size)
but reloc_bo_offset is __u32 (uapi/drm/nouveau_drm.h) and the integer literal 4 promotes to unsigned int, so the addition is performed in 32 bits and wraps before the comparison against the size_t bo size.
Cast to u64 so the addition happens in 64-bit arithmetic.
[ Add Fixes: tag. - Danilo ]
Weakness: CWE-787
Which versions are affected by CVE-2026-46006?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-46006?
Apply the vendor's patch.
Is CVE-2026-46006 being exploited?
There is no known exploitation of CVE-2026-46006 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-88607, BELL-CVE-2026-46006, DEBIAN-CVE-2026-46006, GHSA-66r8-mwch-7x3r, ROOT-OS-DEBIAN-11-CVE-2026-46006, ROOT-OS-DEBIAN-12-CVE-2026-46006 and 3 more.