CVE-2026-98511

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()

nouveau_bo_pin_locked() checks whether an already pinned BO is in a

memory domain compatible with a new pin request. When the domains are

incompatible, it sets -EBUSY but still calls ttm_bo_pin() before

returning.

Callers treat a failed nouveau_bo_pin() as not having acquired a new pin,

so the extra pin count is never decreased by a matching unpin.

This triggers the warning in ttm_bo_release():

WARN_ON_ONCE(bo->pin_count);

Found when fuzzing the nouveau driver with a modified Syzkaller:

WARNING: drivers/gpu/drm/ttm/ttm_bo.c:256 at ttm_bo_release+0x827/0x9e0 drivers/gpu/drm/ttm/ttm_bo.c:256, CPU#1: syz.3.24/2212

Modules linked in:

CPU: 1 UID: 0 PID: 2212 Comm: syz.3.24 Not tainted 7.2.0 #24 PREEMPT(lazy)

nouveau 0000:01:00.0: gsp:msg fn:103 len:0x40/0x20 res:0x19 resp:0x19

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References