CVE-2026-52904: Linux Kernel Nouveau Driver Memory Leak DoS Vulnerability

Technical summary

CVE-2026-52904 is a resource leak in the Nouveau DRM subsystem (drivers/gpu/drm/nouveau). When nvkm_device_pci_new() successfully allocates and initializes a device object during probe, but the subsequent aperture_remove_conflicting_pci_devices() call fails, the error handling path returns immediately without invoking nvkm_device_del(). This omission leaves two resources unreleased: the nvkm_device wrapper itself and the PCI device reference acquired via pci_enable_device(). The issue stems from a recent refactoring that consolidated device creation into a single operation, eliminating an intermediate cleanup point. The correct remediation requires jumping to an existing fail_nvkm label to ensure proper resource deallocation.

Business impact

This vulnerability enables a local denial-of-service condition through resource exhaustion. Unprivileged users can trigger repeated device initialization failures, gradually consuming kernel memory and eventually degrading system performance or causing a crash. In multi-tenant or shared-access environments, this represents a meaningful availability risk. The impact is confined to systems with Nouveau-compatible GPUs and is not exploitable remotely or without local access.

Affected systems

The Linux kernel is affected. Vulnerability manifests on systems running the Nouveau graphics driver, typically found in distributions supporting AMD and NVIDIA discrete GPUs via the open-source stack. The vulnerability is triggered during driver probe, so it affects systems where a Nouveau-capable device is present and the driver initialization sequence encounters the specific failure condition (conflicting PCI apertures).

Exploitability

Exploitability is low in a practical sense. The vulnerability requires local code execution context (unprivileged user) and knowledge of or ability to trigger the aperture conflict scenario. It is not remotely exploitable and does not yield privilege escalation or confidentiality breaches. The CVSS 3.1 score of 5.5 (MEDIUM) reflects the local requirement and availability-only impact. No known public exploits exist; the flaw is a logic error discovered through code analysis rather than active exploitation.

Remediation

Apply a kernel patch that ensures nvkm_device_del() is called unconditionally on probe failure by routing the aperture removal error path through the fail_nvkm label. This guarantees that both the device object and the PCI reference are released. System administrators should upgrade to a patched kernel version once available from their distribution. Verify patch applicability against your vendor's security advisory, as backport versions may vary.

Patch guidance

Monitor your Linux distribution's security advisories for a kernel update addressing CVE-2026-52904. The patch involves a small control-flow correction in the Nouveau probe path; update instructions will be provided by your vendor. For custom kernel users, apply the upstream fix to drivers/gpu/drm/nouveau during your next planned kernel rebuild and reboot cycle. No workaround is available short of disabling the Nouveau driver if the GPU is not required.

Detection guidance

Detection is primarily post-incident via memory pressure and system logs. Monitor for unexplained kernel memory growth and check dmesg/journalctl for repeated 'aperture removal' or 'nvkm_device' related error messages during system boot or GPU hotplug events. Use 'dmesg | grep -i nouveau' to inspect probe-time warnings. Proactive detection requires kernel instrumentation or a patched kernel with enhanced logging; standard intrusion detection systems cannot identify the leak at runtime.

Why prioritize this

Prioritize this patch in a regular maintenance window within the next 1–2 release cycles. The MEDIUM CVSS score and local-only attack vector place it below critical vulnerabilities but above routine updates. Organizations running Nouveau-dependent workloads (particularly in cloud or HPC environments) should prioritize higher due to multi-tenant denial-of-service risk. Environments without Nouveau GPUs or using proprietary drivers may defer safely.

Risk score, explained

CVSS 3.1 score 5.5 (MEDIUM) reflects: (1) local attack vector—no remote trigger possible; (2) low privilege requirement—unprivileged user sufficient; (3) availability impact only—no confidentiality or integrity breach; (4) resource exhaustion is bounded by system RAM but practically achievable by an attacker. The score appropriately discounts this threat relative to RCE or privilege escalation but flags it as a legitimate operational risk in shared-access environments.

Frequently asked questions