https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 03:54:54 +0000 https://vulnerability.circl.lu/vuln/cve-2026-89800 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE</p> <p>A successful OP_UNMAP_SPARSE marks its region dirty with nouveau_uvma_region_dirty() and defers the teardown to nouveau_uvmm_bind_job_cleanup(); it does not remove the region from uvmm-&gt;region_mt.</p> <p>If a later op in the job fails, the unwind path never clears reg-&gt;dirty (set in one place, cleared nowhere) and sets op-&gt;reg = NULL, so cleanup skips the teardown. The region is left in the tree with dirty set and its completion never signalled. Later binds over that range then fail permanently -- -ENOENT or -EINVAL from the dirty checks, or an unkillable wait_for_completion() in bind_validate_region() -- for the lifetime of the uvmm.</p> <p>Clear reg-&gt;dirty when the unwind reverts the sparse unmap, restoring the region to the state it was found in.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE</p> <p>A successful OP_UNMAP_SPARSE marks its region dirty with nouveau_uvma_region_dirty() and defers the teardown to nouveau_uvmm_bind_job_cleanup(); it does not remove the region from uvmm-&gt;region_mt.</p> <p>If a later op in the job fails, the unwind path never clears reg-&gt;dirty (set in one place, cleared nowhere) and sets op-&gt;reg = NULL, so cleanup skips the teardown. The region is left in the tree with dirty set and its completion never signalled. Later binds over that range then fail permanently -- -ENOENT or -EINVAL from the dirty checks, or an unkillable wait_for_completion() in bind_validate_region() -- for the lifetime of the uvmm.</p> <p>Clear reg-&gt;dirty when the unwind reverts the sparse unmap, restoring the region to the state it was found in.</p> https://vulnerability.circl.lu/vuln/cve-2026-89800