{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98511 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-98511 is a denial of service vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-98511 and fix it if it is affected.\n\nWhat it is: CVE-2026-98511 is a denial of service vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-98511 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98511/ (Markdown: https://insights.sbomify.com/CVE-2026-98511/index.md)","id":"CVE-2026-98511","markdown":"https://insights.sbomify.com/CVE-2026-98511/index.md","name":"CVE-2026-98511","record":{"aliases":["AZL-109451","BELL-CVE-2026-98511","DEBIAN-CVE-2026-98511","GHSA-g9v8-hx8g-hw7q","UBUNTU-CVE-2026-98511"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"low_privilege","summary":"A logic error in the nouveau GPU driver causes a kernel warning and potential denial of service when pinning buffer objects fails.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()\n\nnouveau_bo_pin_locked() checks whether an already pinned BO is in a\nmemory domain compatible with a new pin request. When the domains are\nincompatible, it sets -EBUSY but still calls ttm_bo_pin() before\nreturning.\n\nCallers treat a failed nouveau_bo_pin() as not having acquired a new pin,\nso the extra pin count is never decreased by a matching unpin.\nThis triggers the warning in ttm_bo_release():\n\n\tWARN_ON_ONCE(bo-\u003epin_count);\n\nFound when fuzzing the nouveau driver with a modified Syzkaller:\n\n\tWARNING: drivers/gpu/drm/ttm/ttm_bo.c:256 at ttm_bo_release+0x827/0x9e0 drivers/gpu/drm/ttm/ttm_bo.c:256, CPU#1: syz.3.24/2212\n\tModules linked in:\n\tCPU: 1 UID: 0 PID: 2212 Comm: syz.3.24 Not tainted 7.2.0 #24 PREEMPT(lazy)\n\tnouveau 0000:01:00.0: gsp:msg fn:103 len:0x40/0x20 res:0x19 resp:0x19\n\tHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n\tRIP: 0010:ttm_bo_release+0x827/0x9e0 drivers/gpu/drm/ttm/ttm_bo.c:256\n\tCode: 02 00 0f 85 51 01 00 00 48 8b 7b 08 e8 d2 20 01 00 e9 80 fd ff ff e8 d8 15 c0 fe 90 0f 0b 90 e9 e1 f8 ff ff e8 ca 15 c0 fe 90 \u003c0f\u003e 0b 90 e9 a4 f8 ff ff e8 bc 15 c0 fe be 03 00 00 00 4c 89 e7 e8\n\tmsg: 00000000: 05 00 d0 c1 04 00 f0 f1 01 30 00 00 2d 90 00 00  .........0..-...\n\tRSP: 0018:ffffc9000f5cf710 EFLAGS: 00010293\n\tRAX: 0000000000000000 RBX: ffff888018e5d2a8 RCX: ffffffff82bb1b36\n\tRDX: ffff888017b68000 RSI: 0000000000000004 RDI: ffff888018e5d2a8\n\tmsg: 00000010: 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n\tRBP: ffff88801261c720 R08: 0000000000000001 R09: ffffed10031cba55\n\tR10: ffff888018e5d2ab R11: 00000000000000f3 R12: ffff888018e5d290\n\tR13: ffff888018e5d2d4 R14: ffff88801b219c18 R15: dffffc0000000000\n\tFS:  0000000000000000(0000) GS:ffff8880e0f6f000(0000) knlGS:0000000000000000\n\tCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n\tCR2: 0000001b31223ffc CR3: 0000000028e00005 CR4: 0000000000770ef0\n\tPKRU: 80000000\n\tCall Trace:\n\t\u003cTASK\u003e\n\tkref_put include/linux/kref.h:65 [inline]\n\tttm_bo_put drivers/gpu/drm/ttm/ttm_bo.c:325 [inline]\n\tttm_bo_fini+0x55/0x80 drivers/gpu/drm/ttm/ttm_bo.c:330\n\tnouveau_gem_object_del+0xb2/0x1b0 drivers/gpu/drm/nouveau/nouveau_gem.c:90\n\tdrm_gem_object_free+0x5f/0x90 drivers/gpu/drm/drm_gem.c:1165\n\tkref_put include/linux/kref.h:65 [inline]\n\t__drm_gem_object_put include/drm/drm_gem.h:562 [inline]\n\tdrm_gem_object_put include/drm/drm_gem.h:575 [inline]\n\tnouveau_abi16_chan_fini.constprop.0+0x44f/0x5a0 drivers/gpu/drm/nouveau/nouveau_abi16.c:195\n\tnouveau 0000:01:00.0: syz.2.23[2209]: Unknown handle 0x00000000\n\tnouveau_abi16_fini+0x1d0/0x340 drivers/gpu/drm/nouveau/nouveau_abi16.c:225\n\tnouveau_drm_postclose+0x18b/0x3e0 drivers/gpu/drm/nouveau/nouveau_drm.c:1284\n\tnouveau 0000:01:00.0: syz.2.23[2209]: validate_init\n\tdrm_file_free.part.0+0x6d6/0xb60 drivers/gpu/drm/drm_file.c:267\n\tdrm_file_free drivers/gpu/drm/drm_file.c:237 [inline]\n\tdrm_close_helper.isra.0+0x11a/0x160 drivers/gpu/drm/drm_file.c:290\n\tdrm_release+0x1ab/0x330 drivers/gpu/drm/drm_file.c:438\n\t__fput+0x39c/0xa60 fs/file_table.c:512\n\tnouveau 0000:01:00.0: syz.2.23[2209]: validate: -2\n\ttask_work_run+0x15a/0x230 kernel/task_work.c:233\n\texit_task_work include/linux/task_work.h:40 [inline]\n\tdo_exit+0x82b/0x25a0 kernel/exit.c:1009\n\tdo_group_exit+0xc2/0x280 kernel/exit.c:1152\n\tget_signal+0x1d6e/0x1f30 kernel/signal.c:3046\n\tarch_do_signal_or_restart+0x7d/0x6e0 arch/x86/kernel/signal.c:337\n\t__exit_to_user_mode_loop kernel/entry/common.c:66 [inline]\n\texit_to_user_mode_loop+0xdf/0x440 kernel/entry/common.c:101\n\t__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]\n\tsyscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]\n\tsyscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]\n\tdo_syscall_64+0x4f8/0x690 arch/x86/entry/syscall_64.c:100\n\tentry_SYSCALL_64_after_hwframe+0x77/0x7f\n\tRI\n---truncated---","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()","id":"CVE-2026-98511","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":7,"next":{"headline":"drm/nouveau: RCU-free the scheduler-containing nouveau_sched","id":"CVE-2026-98512"},"packages":[],"prev":{"headline":"drm/xe/vm: nuke PTs only after unlinking contested VMAs","id":"CVE-2026-98510"},"products":["Linux"],"published":"2026-10-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A logic error in the nouveau GPU driver causes a kernel warning and potential denial of service when pinning buffer objects fails.","url":"https://insights.sbomify.com/CVE-2026-98511/"}