CVE-2026-98511
Description
A flaw was found in the Linux kernel's Nouveau GPU driver. When attempting to re-pin a memory buffer into an incompatible memory domain, the driver rejects the request but fails to prevent an increment of the buffer's pin count. Because callers do not unpin after an error, this causes an unbalanced pin counter that local users can trigger, resulting in kernel warnings and potentially leading to a Denial of Service (DoS).
Statement
This vulnerability is rated as having a Moderate impact because exploitation is constrained to authenticated local users interacting with the Nouveau DRM graphics interface on systems equipped with NVIDIA hardware. Typical Red Hat Enterprise Linux server installations do not utilize NVIDIA hardware acceleration or open-source graphics drivers, significantly restricting overall exposure. When triggered via mismatched memory domain pin requests, the flaw causes an unpin mismatch that leads to kernel warning assertions or system instability, resulting in a local denial of service without compromising data confidentiality or integrity.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
