In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau: fix a use-after-free in r535_gsp_rpc_push()
The RPC container is released after being passed to r535_gsp_rpc_send().
When sending the initial fragment of a large RPC and passing the caller's RPC container, the container will be freed prematurely. Subsequent attempts to send remaining fragments will therefore result in a use-after-free.
Allocate a temporary RPC container for holding the initial fragment of a large RPC when sending. Free the caller's container when all fragments are successfully sent.
[ Rebase onto Blackwell changes. - Danilo ]
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Suse | — | Upgrade cluster-md-kmp-64kbUpgrade cluster-md-kmp-rtUpgrade kernel-64kb-extraUpgrade dlm-kmp-defaultUpgrade dtb-xilinxUpgrade kernel-develUpgrade kernel-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-default-optionalUpgrade kernel-defaultUpgrade dlm-kmp-rtUpgrade kernel-obs-buildUpgrade kernel-rt-develUpgrade kernel-docsUpgrade kernel-default-baseUpgrade kernel-default-livepatch-develUpgrade reiserfs-kmp-rtUpgrade kernel-rtUpgrade kernel-devel-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-debug-vdsoUpgrade kselftests-kmp-rtUpgrade dtb-qcomUpgrade kernel-syms-rtUpgrade gfs2-kmp-defaultUpgrade kernel-rt-extraUpgrade dtb-nvidiaUpgrade reiserfs-kmp-azureUpgrade dtb-armUpgrade kernel-rt-vdsoUpgrade kselftests-kmp-defaultUpgrade kernel-azure-develUpgrade dlm-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade dtb-mediatekUpgrade dtb-sprdUpgrade kernel-default-base-rebuildUpgrade kernel-source-vanillaUpgrade dtb-rockchipUpgrade dtb-socionextUpgrade kernel-kvmsmall-vdsoUpgrade kernel-64kb-optionalUpgrade dtb-marvellUpgrade gfs2-kmp-azureUpgrade kernel-default-livepatchUpgrade kernel-64kb-develUpgrade kernel-kvmsmall-develUpgrade gfs2-kmp-rtUpgrade dtb-apmUpgrade ocfs2-kmp-64kbUpgrade gfs2-kmp-64kbUpgrade dtb-amlogicUpgrade kernel-rt-optionalUpgrade ocfs2-kmp-rtUpgrade dtb-lgUpgrade reiserfs-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade kernel-source-rtUpgrade kernel-syms-azureUpgrade kernel-rt_debug-develUpgrade kernel-default-vdsoUpgrade kernel-default-develUpgrade dtb-freescaleUpgrade dtb-broadcomUpgrade cluster-md-kmp-azureUpgrade reiserfs-kmp-64kbUpgrade kernel-docs-htmlUpgrade dtb-appleUpgrade kernel-obs-qaUpgrade dtb-renesasUpgrade dtb-caviumUpgrade kernel-sourceUpgrade kernel-devel-azureUpgrade kernel-default-extraUpgrade kernel-debugUpgrade dtb-amdUpgrade dtb-allwinnerUpgrade kernel-azure-optionalUpgrade kernel-macrosUpgrade dtb-alteraUpgrade dlm-kmp-64kbUpgrade ocfs2-kmp-azureUpgrade kernel-zfcpdumpUpgrade dtb-hisiliconUpgrade kernel-azure-extraUpgrade ocfs2-kmp-defaultUpgrade kselftests-kmp-azureUpgrade kernel-symsUpgrade kernel-source-azureUpgrade kernel-rt_debugUpgrade kernel-kvmsmallUpgrade kernel-debug-develUpgrade kernel-64kbUpgrade dtb-exynosUpgrade dtb-amazonUpgrade kernel-azure-vdso | Dec 5, 2025 | Aug 18, 2025 |
| Ubuntu | — | No solution exists | Jul 9, 2025 | Jul 4, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub