CVE-2026-98514

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98514", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.354Z", "datePublished": "2026-10-18T15:17:30.612Z", "dateUpdated": "2026-10-19T09:20:54.190Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:20:54.190Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: Fix gem reference leak in validate_init()\n\nOn the ttm_bo_reserve() failure and \"vma not found\" error paths, the\nloop breaks without adding the looked-up object to any validate list,\nso the reference taken by drm_gem_object_lookup() is never released;\nvalidate_fini() only walks the spliced lists. Drop the reference\nbefore breaking out on both paths."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/nouveau/nouveau_gem.c"], "versions": [{"version": "19ca10d82e33bcfe92412c461fc3534ec1e14747", "lessThan": "af2f48c12365866abb327d75c21a13bbde84719c", "status": "affected", "versionType": "git"}, {"version": "19ca10d82e33bcfe92412c461fc3534ec1e14747", "lessThan": "3c80e069470cf73c357c9edb5ec5fba20e6f6a98", "status": "affected", "versionType": "git"}, {"version": "19ca10d82e33bcfe92412c461fc3534ec1e14747", "lessThan": "957619120c26d6727efd18504e6b488673d3900a", "status": "affected", "versionType": "git"}, {"version": "19ca10d82e33bcfe92412c461fc3534ec1e14747", "lessThan": "74485cdc343060fce08f8f3990da524d783e43a7", "status": "affected", "versionType": "git"}, {"version": "19ca10d82e33bcfe92412c461fc3534ec1e14747", "lessThan": "8281930fc194ad448aaa5de8dd47fb6fb1cba327", "status": "affected", "versionType": "git"}, {"version": "19ca10d82e33bcfe92412c461fc3534ec1e14747", "lessThan": "030e93fc91d55d9487b3b85fc0712bb795d77834", "status": "affected", "versionType": "git"}, {"version": "19ca10d82e33bcfe92412c461fc3534ec1e14747", "lessThan": "9e13c398a23445baf38f0a59033dd9872a2bfe20", "status": "affected", "versionType": "git"}, {"version": "19ca10d82e33bcfe92412c461fc3534ec1e14747", "lessThan": "5ea72f7b7139b123713a7983448f910bc4514d9e", "status": "affected", "versionType": "git"}, {"version": "bcc16811023394a5e61a20c107f1fa560a28b7c1", "status": "affected", "versionType": "git"}, {"version": "4.17.12", "lessThan": "4.18", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/nouveau/nouveau_gem.c"], "versions": [{"version": "4.18", "status": "affected"}, {"version": "0", "lessThan": "4.18", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17.12"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/af2f48c12365866abb327d75c21a13bbde84719c"}, {"url": "https://git.kernel.org/stable/c/3c80e069470cf73c357c9edb5ec5fba20e6f6a98"}, {"url": "https://git.kernel.org/stable/c/957619120c26d6727efd18504e6b488673d3900a"}, {"url": "https://git.kernel.org/stable/c/74485cdc343060fce08f8f3990da524d783e43a7"}, {"url": "https://git.kernel.org/stable/c/8281930fc194ad448aaa5de8dd47fb6fb1cba327"}, {"url": "https://git.kernel.org/stable/c/030e93fc91d55d9487b3b85fc0712bb795d77834"}, {"url": "https://git.kernel.org/stable/c/9e13c398a23445baf38f0a59033dd9872a2bfe20"}, {"url": "https://git.kernel.org/stable/c/5ea72f7b7139b123713a7983448f910bc4514d9e"}], "title": "drm/nouveau: Fix gem reference leak in validate_init()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/nouveau/nouveau_gem.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "af2f48c12365866abb327d75c21a13bbde84719c", "status": "affected", "version": "19ca10d82e33bcfe92412c461fc3534ec1e14747", "versionType": "git"}, {"lessThan": "3c80e069470cf73c357c9edb5ec5fba20e6f6a98", "status": "affected", "version": "19ca10d82e33bcfe92412c461fc3534ec1e14747", "versionType": "git"}, {"lessThan": "957619120c26d6727efd18504e6b488673d3900a", "status": "affected", "version": "19ca10d82e33bcfe92412c461fc3534ec1e14747", "versionType": "git"}, {"lessThan": "74485cdc343060fce08f8f3990da524d783e43a7", "status": "affected", "version": "19ca10d82e33bcfe92412c461fc3534ec1e14747", "versionType": "git"}, {"lessThan": "8281930fc194ad448aaa5de8dd47fb6fb1cba327", "status": "affected", "version": "19ca10d82e33bcfe92412c461fc3534ec1e14747", "versionType": "git"}, {"lessThan": "030e93fc91d55d9487b3b85fc0712bb795d77834", "status": "affected", "version": "19ca10d82e33bcfe92412c461fc3534ec1e14747", "versionType": "git"}, {"lessThan": "9e13c398a23445baf38f0a59033dd9872a2bfe20", "status": "affected", "version": "19ca10d82e33bcfe92412c461fc3534ec1e14747", "versionType": "git"}, {"lessThan": "5ea72f7b7139b123713a7983448f910bc4514d9e", "status": "affected", "version": "19ca10d82e33bcfe92412c461fc3534ec1e14747", "versionType": "git"}, {"status": "affected", "version": "bcc16811023394a5e61a20c107f1fa560a28b7c1", "versionType": "git"}, {"lessThan": "4.18", "status": "affected", "version": "4.17.12", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/nouveau/nouveau_gem.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.18"}, {"lessThan": "4.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: Fix gem reference leak in validate_init()\n\nOn the ttm_bo_reserve() failure and \"vma not found\" error paths, the\nloop breaks without adding the looked-up object to any validate list,\nso the reference taken by drm_gem_object_lookup() is never released;\nvalidate_fini() only walks the spliced lists. Drop the reference\nbefore breaking out on both paths."}], "id": "CVE-2026-98514", "lastModified": "2026-10-19T10:19:05.017", "metrics": {}, "published": "2026-10-18T16:17:02.657", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/030e93fc91d55d9487b3b85fc0712bb795d77834"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3c80e069470cf73c357c9edb5ec5fba20e6f6a98"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5ea72f7b7139b123713a7983448f910bc4514d9e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/74485cdc343060fce08f8f3990da524d783e43a7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8281930fc194ad448aaa5de8dd47fb6fb1cba327"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/957619120c26d6727efd18504e6b488673d3900a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9e13c398a23445baf38f0a59033dd9872a2bfe20"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/af2f48c12365866abb327d75c21a13bbde84719c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/nouveau: Fix gem reference leak in validate_init()", "id": "2554859", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554859"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-911", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/nouveau: Fix gem reference leak in validate_init()\nOn the ttm_bo_reserve() failure and \"vma not found\" error paths, the\nloop breaks without adding the looked-up object to any validate list,\nso the reference taken by drm_gem_object_lookup() is never released;\nvalidate_fini() only walks the spliced lists. Drop the reference\nbefore breaking out on both paths.", "A flaw was found in the Linux kernel's Nouveau graphics driver, which can lead to a Denial of Service (DoS). A local user can trigger this flaw during graphics buffer validation operations that encounter specific error paths. Because the driver fails to properly release object references when these errors occur, the unreleased objects cause a reference leak. Repeated exploitation can exhaust system memory resources and compromise system availability."], "name": "CVE-2026-98514", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98514\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98514\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98514.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[19ca10d82e33bcfe92412c461fc3534ec1e14747,af2f48c12365866abb327d75c21a13bbde84719c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[19ca10d82e33bcfe92412c461fc3534ec1e14747,3c80e069470cf73c357c9edb5ec5fba20e6f6a98)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[19ca10d82e33bcfe92412c461fc3534ec1e14747,957619120c26d6727efd18504e6b488673d3900a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[19ca10d82e33bcfe92412c461fc3534ec1e14747,74485cdc343060fce08f8f3990da524d783e43a7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[19ca10d82e33bcfe92412c461fc3534ec1e14747,8281930fc194ad448aaa5de8dd47fb6fb1cba327)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[19ca10d82e33bcfe92412c461fc3534ec1e14747,030e93fc91d55d9487b3b85fc0712bb795d77834)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[19ca10d82e33bcfe92412c461fc3534ec1e14747,9e13c398a23445baf38f0a59033dd9872a2bfe20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[19ca10d82e33bcfe92412c461fc3534ec1e14747,5ea72f7b7139b123713a7983448f910bc4514d9e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "bcc16811023394a5e61a20c107f1fa560a28b7c1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.17.12,4.18)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.271,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.222,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-19T00:15:14.331925+00:00", "updated": "2026-10-20T20:45:14.321372+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}