{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98517 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-98517 is a high-severity use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-98517 and fix it if it is affected.\n\nWhat it is: CVE-2026-98517 is a high-severity use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-98517 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98517/ (Markdown: https://insights.sbomify.com/CVE-2026-98517/index.md)","id":"CVE-2026-98517","markdown":"https://insights.sbomify.com/CVE-2026-98517/index.md","name":"CVE-2026-98517","record":{"aliases":["AZL-109032","BELL-CVE-2026-98517","DEBIAN-CVE-2026-98517","GHSA-3g6p-gg5m-mwxx","UBUNTU-CVE-2026-98517"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"low_privilege","summary":"A use-after-free vulnerability in the Linux kernel's nouveau driver allows local attackers to execute arbitrary code or escalate privileges.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM\n\nnouveau_uvmm_sm() calls op_map(), which passes bo-\u003eresource through\nnouveau_mem() to nouveau_uvma_map(). nouveau_uvmm_vmm_map() then reads\nmem-\u003emem.type.\n\nBut this is only valid when bo-\u003eresource is backed by struct nouveau_mem,\nas is the case for VRAM and TT resources. If the BO is left in\nTTM_PL_SYSTEM, bo-\u003eresource is only a struct ttm_resource. Treating it\nas struct nouveau_mem makes the mem-\u003emem.type read past the end of the\nresource, causing a KASAN: slab-use-after-free Read in nouveau_uvmm_sm\nreport:\n\nBUG: KASAN: slab-use-after-free in nouveau_uvmm_vmm_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:152 [inline]\nBUG: KASAN: slab-use-after-free in nouveau_uvma_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:199 [inline]\nBUG: KASAN: slab-use-after-free in op_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:849 [inline]\nBUG: KASAN: slab-use-after-free in nouveau_uvmm_sm.constprop.0+0x6ab/0x900 drivers/gpu/drm/nouveau/nouveau_uvmm.c:903\nRead of size 1 at addr ffff888127d3e3a0 by task kworker/0:1/11\n\nCPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 7.2.0 #5 PREEMPT(lazy)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nWorkqueue: nouveau_sched_wq_2224 drm_sched_run_job_work\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x95/0xe0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xcb/0x5a0 mm/kasan/report.c:482\n kasan_report+0xca/0x100 mm/kasan/report.c:595\n nouveau_uvmm_vmm_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:152 [inline]\n nouveau_uvma_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:199 [inline]\n op_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:849 [inline]\n nouveau_uvmm_sm.constprop.0+0x6ab/0x900 drivers/gpu/drm/nouveau/nouveau_uvmm.c:903\n nouveau_uvmm_sm_unmap drivers/gpu/drm/nouveau/nouveau_uvmm.c:932 [inline]\n nouveau_uvmm_bind_job_run+0xd6/0x250 drivers/gpu/drm/nouveau/nouveau_uvmm.c:1532\n nouveau_job_run drivers/gpu/drm/nouveau/nouveau_sched.c:350 [inline]\n nouveau_sched_run_job+0x62/0xd0 drivers/gpu/drm/nouveau/nouveau_sched.c:364\n drm_sched_run_job_work+0x356/0xa10 drivers/gpu/drm/scheduler/sched_main.c:1061\n process_one_work+0x8a5/0x1900 kernel/workqueue.c:3322\n process_scheduled_works kernel/workqueue.c:3405 [inline]\n worker_thread+0x5dd/0xd80 kernel/workqueue.c:3486\n kthread+0x31d/0x420 kernel/kthread.c:436\n ret_from_fork+0x662/0x940 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u003c/TASK\u003e\n\nAllocated by task 2224 on cpu 0 at 66.550027s:\n kasan_save_stack+0x24/0x50 mm/kasan/common.c:57\n kasan_save_track+0x17/0x60 mm/kasan/common.c:78\n poison_kmalloc_redzone mm/kasan/common.c:398 [inline]\n __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415\n kasan_kmalloc include/linux/kasan.h:263 [inline]\n __do_kmalloc_node mm/slub.c:5334 [inline]\n __kmalloc_noprof+0x304/0x7c0 mm/slub.c:5359\n _kmalloc_noprof include/linux/slab.h:992 [inline]\n dma_resv_list_alloc+0x27/0x90 drivers/dma-buf/dma-resv.c:106\n dma_resv_reserve_fences+0x60e/0xa30 drivers/dma-buf/dma-resv.c:205\n ttm_bo_alloc_resource+0x12c/0xbd0 drivers/gpu/drm/ttm/ttm_bo.c:721\n ttm_bo_validate+0x1bc/0x4a0 drivers/gpu/drm/ttm/ttm_bo.c:856\n ttm_bo_init_reserved+0x2c3/0x570 drivers/gpu/drm/ttm/ttm_bo.c:970\n nouveau_bo_init+0x159/0x2c0 drivers/gpu/drm/nouveau/nouveau_bo.c:359\n nouveau_gem_new+0x234/0x5f0 drivers/gpu/drm/nouveau/nouveau_gem.c:272\n nouveau_gem_ioctl_new+0x1eb/0x420 drivers/gpu/drm/nouveau/nouveau_gem.c:352\n drm_ioctl_kernel+0x192/0x350 drivers/gpu/drm/drm_ioctl.c:817\n drm_ioctl+0x4f8/0xb40 drivers/gpu/drm/drm_ioctl.c:914\n nouveau_drm_ioctl+0xea/0x2c0 drivers/gpu/drm/nouveau/nouveau_drm.c:1338\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x180/0x1d0 fs/ioctl.c:583\n do_syscall_x64 ar\n---truncated---","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM","id":"CVE-2026-98517","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"drm/nouveau/dmem: pin VRAM for the whole registered range","id":"CVE-2026-98518"},"packages":[],"prev":{"headline":"drm/nouveau: Fix bridge reference leak in nv1a_ram_new()","id":"CVE-2026-98516"},"products":["Linux"],"published":"2026-10-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-24","vendors":["Linux"]},"summary":"A use-after-free vulnerability in the Linux kernel's nouveau driver allows local attackers to execute arbitrary code or escalate privileges.","url":"https://insights.sbomify.com/CVE-2026-98517/"}