CVE-2026-68271
CVE CVE-2026-68271EUVD EUVD-2026-55372Published 2026-08-10T12:01:46.000Z
What the advisory describes
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix reversed error cleanup order in ucopy functions nouveau_uvmm_vm_bind_ucopy() and nouveau_exec_ucopy() place their error cleanup labels in allocation order rather than reverse allocation order. On a u_memcpya() failure for in_sync.s, the goto to err_free_ops (or err_free_pushs) frees the first allocation and then falls through to err_free_ins, which calls u_free() on args->in_sync.s. Since args->in_sync.s still holds the ERR_PTR returned by the failed u_memcpya(), and ERR_PTR values are not caught by ZERO_OR_NULL_PTR(), kvfree() proceeds to dereference it, which can result in a kernel oops. A failure for out_sync.s instead jumps to err_free_ins and skips freeing the first allocation, leading to a memory leak. Fix by swapping the cleanup label order so resources are freed in the correct reverse allocation sequence.
Source: EUVD (ENISA), in the words of the advisory.
Products the advisory names
These come from the advisory itself, not from any check we performed.
- Linux — Linux patch: 6.12.101; b88baab828713ce0b49b185444b2ee83bed373a8 <e15c25c7972d38a9f6bf8c3f7f29179a67263eba; b88baab828713ce0b49b185444b2ee83bed373a8 <ebbaf64d2635d1e78196c067fa8fa582a7dc17f7; patch: 6.18.42; b88baab828713ce0b49b185444b2ee83bed373a8 <ab99ead646b1b833ecd57fe577a2816f2e848167; patch: 7.2-rc1; 6.6; patch: 0; patch: 6.6.148; patch: 7.1.6; b88baab828713ce0b49b185444b2ee83bed373a8 <4e109faa9ea2b6c04cc5a99e76db3126575a59d1; b88baab828713ce0b49b185444b2ee83bed373a8 <2473ac314387a5def7244eb6d6a345934ed140bf
The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.
Carried in the product catalogue
An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.
- Linux — Linux
Does this concern one of your customers?
This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.
Try it for 28 daysPatchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.