Riskcovery

CVE-2020-36788

drm/nouveau: avoid a use-after-free when BO init fails

State
Published
Severity
7.8 High
Published
May 21, 2024
Updated
Aug 5, 2026
Reserved
Feb 26, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: avoid a use-after-free when BO init fails

nouveau_bo_init() is backed by ttm_bo_init() and ferries its return code back to the caller. On failures, ttm_bo_init() invokes the provided destructor which should de-initialize and free the memory.

Thus, when nouveau_bo_init() returns an error the gem object has already been released and the memory freed by nouveau_bo_del_ttm().

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 to before f86e19d918a85492ad1a01fcdc0ad5ecbdac6f96Affected
  • 019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 to before 548f2ff8ea5e0ce767ae3418d1ec5308990be87dAffected
  • 019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 to before bcf34aa5082ee2343574bc3f4d1c126030913e54Affected
LinuxLinux
  • 5.4Affected
  • before 5.4Not affected
  • 5.10.73 through 5.10.*Not affected
  • 5.14.12 through 5.14.*Not affected
  • 5.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.