CVE-2022-50454

drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()

State: Published
Severity: 7.8 High
Published: Oct 1, 2025
Updated: Aug 5, 2026
Reserved: Oct 1, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()

nouveau_bo_init() is backed by ttm_bo_init() and ferries its return code back to the caller. On failures, ttm will call nouveau_bo_del_ttm() and free the memory.Thus, when nouveau_bo_init() returns an error, the gem object has already been released. Then the call to nouveau_bo_ref() will use the freed "nvbo->bo" and lead to a use-after-free bug.

We should delete the call to nouveau_bo_ref() to avoid the use-after-free.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 to before 56ee9577915dc06f55309901012a9ef68dbdb5a8Affected 019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 to before 5d6093c49c098d86c7b136aba9922df44aeb6944Affected 019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 to before 861f085f81fd569b02cc2c11165a9e6cca144424Affected 019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 to before 3aeda2fe6517cc52663d4ce3588dd43f0d4124a7Affected 019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 to before 7d80473e9f12548ac05b36af4fb9ce80f2f73509Affected 019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 to before 540dfd188ea2940582841c1c220bd035a7db0e51Affected
LinuxLinux	5.4Affected before 5.4Not affected 5.4.220 through 5.4.Not affected 5.10.150 through 5.10.Not affected 5.15.75 through 5.15.Not affected 5.19.17 through 5.19.Not affected 6.0.3 through 6.0.*Not affected 6.1 and laterNot affected

Product

Versions

LinuxLinux

019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 to before 56ee9577915dc06f55309901012a9ef68dbdb5a8Affected
019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 to before 5d6093c49c098d86c7b136aba9922df44aeb6944Affected
019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 to before 861f085f81fd569b02cc2c11165a9e6cca144424Affected
019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 to before 3aeda2fe6517cc52663d4ce3588dd43f0d4124a7Affected
019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 to before 7d80473e9f12548ac05b36af4fb9ce80f2f73509Affected
019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 to before 540dfd188ea2940582841c1c220bd035a7db0e51Affected

LinuxLinux

5.4Affected
before 5.4Not affected
5.4.220 through 5.4.*Not affected
5.10.150 through 5.10.*Not affected
5.15.75 through 5.15.*Not affected
5.19.17 through 5.19.*Not affected
6.0.3 through 6.0.*Not affected
6.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.