{"id":"AZL-101243","summary":"CVE-2026-89802 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op\n\nEach bind_job_op is zeroed by kzalloc_obj() in bind_job_op_from_uop(),\nand the OP_MAP_SPARSE case in nouveau_uvmm_bind_job_submit() only creates\na region, so op-\u003eops stays NULL for a successfully processed sparse map.\n\nIf a later op in the same job fails, the reverse unwind loop revisits that\nop and calls drm_gpuva_ops_free(&uvmm-\u003ebase, op-\u003eops) unconditionally.\ndrm_gpuva_ops_free() dereferences its argument right away\n(list_for_each_entry_safe on &ops-\u003elist), so a NULL op-\u003eops oopses. The\npath is reachable by any render-node fd holder, since NOUVEAU_VM_BIND is\nDRM_RENDER_ALLOW.\n\nGuard the free with IS_ERR_OR_NULL(), as nouveau_uvmm_bind_job_cleanup()\nalready does for the identical free.","modified":"2026-09-17T14:15:47.812060515Z","published":"2026-09-16T11:16:45Z","upstream":["CVE-2026-89802"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89802"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-101243.json"}}],"schema_version":"1.9.0"}