CVE-2026-89804

CVE CVE-2026-89804EUVD EUVD-2026-80404Published 2026-09-16T10:30:37.000ZLast changed 2026-09-16T14:38:49.000ZCVSS 8.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: fix mismatched DMA unmap size for large folios Device-private THP migration maps migration buffers with page_size() and records that length in dma_info->size. For a compound folio page_size() is PAGE_SIZE << order, but two teardown sites still pass a literal PAGE_SIZE to dma_unmap_page(): - nouveau_dmem_migrate_to_ram() on the success path, and - nouveau_dmem_migrate_copy_one() on the copy-error path. For an order > 0 folio this unmaps less than was mapped, leaking the remainder of the IOMMU/IOVA mapping. The other unmap sites, in nouveau_dmem_migrate_chunk() and nouveau_dmem_evict_chunk(), already use the saved size; use it here too.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux patch: 0; patch: 7.3-rc2; c3228747107705d47c7e9a03598a434a0380cb73 <caa1bc2a0a6ca19dcb90bbf88208b0fe2decd66f; 6.19; patch: 7.2.5; c3228747107705d47c7e9a03598a434a0380cb73 <4deb29b9d33bfdb3de4d2d9944947ecf77221e42

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.