VYPR
← All advisories
Unrated severityNVD Advisory· Published Jun 9, 2026

CVE-2026-52904

CVE-2026-52904

Description

Linux kernel's nouveau driver leaks device resources on aperture removal failure, potentially impacting system stability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Linux kernel's nouveau driver leaks device resources on aperture removal failure, potentially impacting system stability.

Vulnerability

In the Linux kernel's drm/nouveau driver, a resource leak occurs when aperture_remove_conflicting_pci_devices() fails during the device probe process. The error path returns prematurely without properly releasing the nvkm_device allocated by nvkm_device_pci_new(), leading to a leak of both the device wrapper and a pci_enable_device() reference. This issue was introduced when an intermediate nvkm_device_del() call was removed. The affected versions are not explicitly detailed in the provided references, but the fix is present in the kernel commit 4404d7d2dda4f3cc84a8fb6ac5417a2afc3b22d6 [4].

Exploitation

Exploitation of this vulnerability is not directly described in the available references. However, it is triggered during the probe process of the drm/nouveau driver when aperture_remove_conflicting_pci_devices() encounters an error. Successful exploitation would require the specific failure condition to occur during device initialization, which may be difficult to trigger intentionally.

Impact

The primary impact of this vulnerability is a resource leak within the Linux kernel's drm/nouveau driver. This leak involves the nvkm_device wrapper and a pci_enable_device() reference. While not directly leading to code execution or data compromise, persistent resource leaks can degrade system performance and potentially lead to system instability or crashes over time, especially if the probe function is called repeatedly.

Mitigation

The vulnerability has been resolved in the Linux kernel with the commit 4404d7d2dda4f3cc84a8fb6ac5417a2afc3b22d6 [4], which ensures that nvkm_device_del() is called to properly unwind the allocated resources. Users are advised to update to a kernel version containing this fix. No workarounds are described in the available references, and the vulnerability is not listed as actively exploited or end-of-life.

References
  1. Making sure you're not a bot!

AI Insight generated on Jun 9, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

1

Patches

8
6597ff1d8de3

drm/nouveau: fix nvkm_device leak on aperture removal failure

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitDavid CarlierApr 11, 2026Fixed in 7.1-rc1via kernel-cna
commit
1 file changed · +1 −2
  • drivers/gpu/drm/nouveau/nouveau_drm.c+1 −2 modified
    diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 915f73279302d..0c23398dd4f1d 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -874,7 +874,7 @@ static int nouveau_drm_probe(struct pci_dev *pdev,
 	/* Remove conflicting drivers (vesafb, efifb etc). */
 	ret = aperture_remove_conflicting_pci_devices(pdev, driver_pci.name);
 	if (ret)
-		return ret;
+		goto fail_nvkm;
 
 	pci_set_master(pdev);
 
-- 
cgit 1.3-korg
5edd564ccb00

drm/nouveau: fix nvkm_device leak on aperture removal failure

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitDavid CarlierApr 11, 2026Fixed in 6.12.86via kernel-cna
commit
1 file changed · +1 −2
  • drivers/gpu/drm/nouveau/nouveau_drm.c+1 −2 modified
    diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 6e5adab034713..2216db0aa9d54 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -853,7 +853,7 @@ static int nouveau_drm_probe(struct pci_dev *pdev,
 	/* Remove conflicting drivers (vesafb, efifb etc). */
 	ret = drm_aperture_remove_conflicting_pci_framebuffers(pdev, &driver_pci);
 	if (ret)
-		return ret;
+		goto fail_nvkm;
 
 	pci_set_master(pdev);
 
-- 
cgit 1.3-korg
4404d7d2dda4

drm/nouveau: fix nvkm_device leak on aperture removal failure

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitDavid CarlierApr 11, 2026Fixed in 6.18.27via kernel-cna
commit
1 file changed · +1 −2
  • drivers/gpu/drm/nouveau/nouveau_drm.c+1 −2 modified
    diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index dc469e571c0aa..b760586b1727e 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -874,7 +874,7 @@ static int nouveau_drm_probe(struct pci_dev *pdev,
 	/* Remove conflicting drivers (vesafb, efifb etc). */
 	ret = aperture_remove_conflicting_pci_devices(pdev, driver_pci.name);
 	if (ret)
-		return ret;
+		goto fail_nvkm;
 
 	pci_set_master(pdev);
 
-- 
cgit 1.3-korg
843c0247cf21

drm/nouveau: fix nvkm_device leak on aperture removal failure

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitDavid CarlierApr 11, 2026Fixed in 7.0.4via kernel-cna
commit
1 file changed · +1 −2
  • drivers/gpu/drm/nouveau/nouveau_drm.c+1 −2 modified
    diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 915f73279302d..0c23398dd4f1d 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -874,7 +874,7 @@ static int nouveau_drm_probe(struct pci_dev *pdev,
 	/* Remove conflicting drivers (vesafb, efifb etc). */
 	ret = aperture_remove_conflicting_pci_devices(pdev, driver_pci.name);
 	if (ret)
-		return ret;
+		goto fail_nvkm;
 
 	pci_set_master(pdev);
 
-- 
cgit 1.3-korg
4404d7d2dda4

drm/nouveau: fix nvkm_device leak on aperture removal failure

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitDavid CarlierApr 11, 2026via nvd-ref
commit
1 file changed · +1 −2
  • drivers/gpu/drm/nouveau/nouveau_drm.c+1 −2 modified
    diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index dc469e571c0aa..b760586b1727e 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -874,7 +874,7 @@ static int nouveau_drm_probe(struct pci_dev *pdev,
 	/* Remove conflicting drivers (vesafb, efifb etc). */
 	ret = aperture_remove_conflicting_pci_devices(pdev, driver_pci.name);
 	if (ret)
-		return ret;
+		goto fail_nvkm;
 
 	pci_set_master(pdev);
 
-- 
cgit 1.3-korg
5edd564ccb00

drm/nouveau: fix nvkm_device leak on aperture removal failure

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitDavid CarlierApr 11, 2026via nvd-ref
commit
1 file changed · +1 −2
  • drivers/gpu/drm/nouveau/nouveau_drm.c+1 −2 modified
    diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 6e5adab034713..2216db0aa9d54 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -853,7 +853,7 @@ static int nouveau_drm_probe(struct pci_dev *pdev,
 	/* Remove conflicting drivers (vesafb, efifb etc). */
 	ret = drm_aperture_remove_conflicting_pci_framebuffers(pdev, &driver_pci);
 	if (ret)
-		return ret;
+		goto fail_nvkm;
 
 	pci_set_master(pdev);
 
-- 
cgit 1.3-korg
6597ff1d8de3

drm/nouveau: fix nvkm_device leak on aperture removal failure

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitDavid CarlierApr 11, 2026via nvd-ref
commit
1 file changed · +1 −2
  • drivers/gpu/drm/nouveau/nouveau_drm.c+1 −2 modified
    diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 915f73279302d..0c23398dd4f1d 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -874,7 +874,7 @@ static int nouveau_drm_probe(struct pci_dev *pdev,
 	/* Remove conflicting drivers (vesafb, efifb etc). */
 	ret = aperture_remove_conflicting_pci_devices(pdev, driver_pci.name);
 	if (ret)
-		return ret;
+		goto fail_nvkm;
 
 	pci_set_master(pdev);
 
-- 
cgit 1.3-korg
843c0247cf21

drm/nouveau: fix nvkm_device leak on aperture removal failure

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitDavid CarlierApr 11, 2026via nvd-ref
commit
1 file changed · +1 −2
  • drivers/gpu/drm/nouveau/nouveau_drm.c+1 −2 modified
    diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 915f73279302d..0c23398dd4f1d 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -874,7 +874,7 @@ static int nouveau_drm_probe(struct pci_dev *pdev,
 	/* Remove conflicting drivers (vesafb, efifb etc). */
 	ret = aperture_remove_conflicting_pci_devices(pdev, driver_pci.name);
 	if (ret)
-		return ret;
+		goto fail_nvkm;
 
 	pci_set_master(pdev);
 
-- 
cgit 1.3-korg

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

4

News mentions

1