CVE-2026-93233

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau/dmem: fix callocated underflow on large folio split

nouveau_dmem_folio_free() drops chunk->callocated once per freed folio,

while a large (compound) device-private folio is only counted once when

it is allocated. When such a folio is split, the mm core invokes

->folio_split() (nouveau_dmem_folio_split()) once for each new

sub-folio, but the hook only fixes up the sub-folio metadata and leaves

chunk->callocated unchanged.

Each resulting sub-folio is later freed separately, so after a split

the single allocation (+1) is met by N frees (-N), leaving

chunk->callocated short by N-1. On the first split/free cycle it

underflows: WARN_ON(!chunk->callocated) fires, the unsigned counter

wraps and never returns to zero, so the chunk can no longer be

reclaimed (nouveau_dmem_fini() also warns on the leaked count).

Account for the new sub-folio in the split hook, under the same lock as

nouveau_dmem_folio_free(), so

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References