CVE-2026-68271
drm/nouveau: fix reversed error cleanup order in ucopy functions
Description
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix reversed error cleanup order in ucopy functions nouveau_uvmm_vm_bind_ucopy() and nouveau_exec_ucopy() place their error cleanup labels in allocation order rather than reverse allocation order. On a u_memcpya() failure for in_sync.s, the goto to err_free_ops (or err_free_pushs) frees the first allocation and then falls through to err_free_ins, which calls u_free() on args->in_sync.s. Since args->in_sync.s still holds the ERR_PTR returned by the failed u_memcpya(), and ERR_PTR values are not caught by ZERO_OR_NULL_PTR(), kvfree() proceeds to dereference it, which can result in a kernel oops. A failure for out_sync.s instead jumps to err_free_ins and skips freeing the first allocation, leading to a memory leak. Fix by swapping the cleanup label order so resources are freed in the correct reverse allocation sequence.
INFO
Published Date :
Aug. 10, 2026, 1:20 p.m.
Last Modified :
Aug. 17, 2026, 5:18 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Update the Linux kernel to the latest version.
- Apply the patch for the reversed error cleanup order.
- Ensure resources are freed in correct reverse allocation sequence.
- Verify the fix prevents kernel oops and memory leaks.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-68271.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-68271 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-68271
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-68271 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-68271 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'b88baab828713ce0b49b185444b2ee83bed373a8', 'lessThan': '2473ac314387a5def7244eb6d6a345934ed140bf', 'versionType': 'git'}, {'status': 'affected', 'version': 'b88baab828713ce0b49b185444b2ee83bed373a8', 'lessThan': 'e15c25c7972d38a9f6bf8c3f7f29179a67263eba', 'versionType': 'git'}, {'status': 'affected', 'version': 'b88baab828713ce0b49b185444b2ee83bed373a8', 'lessThan': '4e109faa9ea2b6c04cc5a99e76db3126575a59d1', 'versionType': 'git'}, {'status': 'affected', 'version': 'b88baab828713ce0b49b185444b2ee83bed373a8', 'lessThan': 'ebbaf64d2635d1e78196c067fa8fa582a7dc17f7', 'versionType': 'git'}, {'status': 'affected', 'version': 'b88baab828713ce0b49b185444b2ee83bed373a8', 'lessThan': 'ab99ead646b1b833ecd57fe577a2816f2e848167', 'versionType': 'git'}], 'programFiles': ['drivers/gpu/drm/nouveau/nouveau_exec.c', 'drivers/gpu/drm/nouveau/nouveau_uvmm.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.6'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.6', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/gpu/drm/nouveau/nouveau_exec.c', 'drivers/gpu/drm/nouveau/nouveau_uvmm.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'b88baab828713ce0b49b185444b2ee83bed373a8', 'lessThan': '2473ac314387a5def7244eb6d6a345934ed140bf', 'versionType': 'git'}, {'status': 'affected', 'version': 'b88baab828713ce0b49b185444b2ee83bed373a8', 'lessThan': 'e15c25c7972d38a9f6bf8c3f7f29179a67263eba', 'versionType': 'git'}, {'status': 'affected', 'version': 'b88baab828713ce0b49b185444b2ee83bed373a8', 'lessThan': '4e109faa9ea2b6c04cc5a99e76db3126575a59d1', 'versionType': 'git'}, {'status': 'affected', 'version': 'b88baab828713ce0b49b185444b2ee83bed373a8', 'lessThan': 'ebbaf64d2635d1e78196c067fa8fa582a7dc17f7', 'versionType': 'git'}, {'status': 'affected', 'version': 'b88baab828713ce0b49b185444b2ee83bed373a8', 'lessThan': 'ab99ead646b1b833ecd57fe577a2816f2e848167', 'versionType': 'git'}], 'programFiles': ['drivers/gpu/drm/nouveau/nouveau_exec.c', 'drivers/gpu/drm/nouveau/nouveau_uvmm.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.6'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.6', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/gpu/drm/nouveau/nouveau_exec.c', 'drivers/gpu/drm/nouveau/nouveau_uvmm.c'], 'defaultStatus': 'affected'}] -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 10, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'b88baab828713ce0b49b185444b2ee83bed373a8', 'lessThan': '2473ac314387a5def7244eb6d6a345934ed140bf', 'versionType': 'git'}, {'status': 'affected', 'version': 'b88baab828713ce0b49b185444b2ee83bed373a8', 'lessThan': 'e15c25c7972d38a9f6bf8c3f7f29179a67263eba', 'versionType': 'git'}, {'status': 'affected', 'version': 'b88baab828713ce0b49b185444b2ee83bed373a8', 'lessThan': '4e109faa9ea2b6c04cc5a99e76db3126575a59d1', 'versionType': 'git'}, {'status': 'affected', 'version': 'b88baab828713ce0b49b185444b2ee83bed373a8', 'lessThan': 'ebbaf64d2635d1e78196c067fa8fa582a7dc17f7', 'versionType': 'git'}, {'status': 'affected', 'version': 'b88baab828713ce0b49b185444b2ee83bed373a8', 'lessThan': 'ab99ead646b1b833ecd57fe577a2816f2e848167', 'versionType': 'git'}], 'programFiles': ['drivers/gpu/drm/nouveau/nouveau_exec.c', 'drivers/gpu/drm/nouveau/nouveau_uvmm.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.6'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.6', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/gpu/drm/nouveau/nouveau_exec.c', 'drivers/gpu/drm/nouveau/nouveau_uvmm.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix reversed error cleanup order in ucopy functions nouveau_uvmm_vm_bind_ucopy() and nouveau_exec_ucopy() place their error cleanup labels in allocation order rather than reverse allocation order. On a u_memcpya() failure for in_sync.s, the goto to err_free_ops (or err_free_pushs) frees the first allocation and then falls through to err_free_ins, which calls u_free() on args->in_sync.s. Since args->in_sync.s still holds the ERR_PTR returned by the failed u_memcpya(), and ERR_PTR values are not caught by ZERO_OR_NULL_PTR(), kvfree() proceeds to dereference it, which can result in a kernel oops. A failure for out_sync.s instead jumps to err_free_ins and skips freeing the first allocation, leading to a memory leak. Fix by swapping the cleanup label order so resources are freed in the correct reverse allocation sequence. Added Reference https://git.kernel.org/stable/c/2473ac314387a5def7244eb6d6a345934ed140bf Added Reference https://git.kernel.org/stable/c/4e109faa9ea2b6c04cc5a99e76db3126575a59d1 Added Reference https://git.kernel.org/stable/c/ab99ead646b1b833ecd57fe577a2816f2e848167 Added Reference https://git.kernel.org/stable/c/e15c25c7972d38a9f6bf8c3f7f29179a67263eba Added Reference https://git.kernel.org/stable/c/ebbaf64d2635d1e78196c067fa8fa582a7dc17f7