{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "5f03a507b29e44a848f315c7240c19894dd8be4f"
            },
            {
              "fixed": "40edf5eefc3fd94592a91d6eb074d4fc6f606c75"
            },
            {
              "fixed": "35151e9a8274174ccbb92e3b3ba7dc7a008dcada"
            },
            {
              "fixed": "cd6e11b6ebe04a0a1f1435df561acada9eadc563"
            },
            {
              "fixed": "f7eae6d8d768fabd6b59779ca7da79e02c74e113"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.8.0"
            },
            {
              "fixed": "6.12.112"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.55"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98512.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: RCU-free the scheduler-containing nouveau_sched\n\nstruct nouveau_sched embeds a struct drm_gpu_scheduler (base).\nnouveau_sched_destroy() calls nouveau_sched_fini() (which does\ndrm_sched_fini(\u0026sched-\u003ebase)) and then frees the object with plain\nkfree(sched).\n\ndrm_sched_fence_get_timeline_name() returns fence-\u003esched-\u003ename, and the\nscheduler fence keeps a .release callback so it is not ops-detached on\nsignalling.  A finished fence exported to userspace via drm_syncobj /\nsync_file therefore keeps pointing at \u0026sched-\u003ebase after nouveau_sched_destroy(),\nand a later get_timeline_name() -- reachable unprivileged through\nSYNC_IOC_FILE_INFO -- dereferences freed memory (KASAN slab-use-after-free\nread).\n\nPer the dma-fence lifetime contract the exporter must keep the data backing a\nsignalled fence alive for an RCU grace period.  Free the scheduler-containing\nobject with kfree_rcu() instead of kfree().",
  "id": "CVE-2026-98512",
  "modified": "2026-10-20T02:30:19.793363143Z",
  "published": "2026-10-18T15:17:27.102Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/35151e9a8274174ccbb92e3b3ba7dc7a008dcada"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/40edf5eefc3fd94592a91d6eb074d4fc6f606c75"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cd6e11b6ebe04a0a1f1435df561acada9eadc563"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f7eae6d8d768fabd6b59779ca7da79e02c74e113"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98512.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98512"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "drm/nouveau: RCU-free the scheduler-containing nouveau_sched"
}