{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.113-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.9-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  drm/nouveau: RCU-free the scheduler-containing nouveau_sched  struct nouveau_sched embeds a struct drm_gpu_scheduler (base). nouveau_sched_destroy() calls nouveau_sched_fini() (which does drm_sched_fini(\u0026sched-\u003ebase)) and then frees the object with plain kfree(sched).  drm_sched_fence_get_timeline_name() returns fence-\u003esched-\u003ename, and the scheduler fence keeps a .release callback so it is not ops-detached on signalling.  A finished fence exported to userspace via drm_syncobj / sync_file therefore keeps pointing at \u0026sched-\u003ebase after nouveau_sched_destroy(), and a later get_timeline_name() -- reachable unprivileged through SYNC_IOC_FILE_INFO -- dereferences freed memory (KASAN slab-use-after-free read).  Per the dma-fence lifetime contract the exporter must keep the data backing a signalled fence alive for an RCU grace period.  Free the scheduler-containing object with kfree_rcu() instead of kfree().",
  "id": "DEBIAN-CVE-2026-98512",
  "modified": "2026-10-19T04:47:42.434537536Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98512"
    }
  ],
  "upstream": [
    "CVE-2026-98512"
  ]
}