In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau: fix a use-after-free in r535_gsp_rpc_push()
The RPC container is released after being passed to r535_gsp_rpc_send().
When sending the initial fragment of a large RPC and passing the caller's RPC container, the container will be freed prematurely. Subsequent attempts to send remaining fragments will therefore result in a use-after-free.
Allocate a temporary RPC container for holding the initial fragment of a large RPC when sending. Free the caller's container when all fragments are successfully sent.
[ Rebase onto Blackwell changes. - Danilo ]
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Suse | — | Upgrade kernel-rt_debug-vdsoUpgrade kernel-syms-rtUpgrade kernel-docsUpgrade kernel-obs-buildUpgrade kernel-rtUpgrade kernel-rt-develUpgrade kernel-default-base-rebuildUpgrade dlm-kmp-azureUpgrade kernel-defaultUpgrade kernel-devel-rtUpgrade kselftests-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade kernel-source-vanillaUpgrade kernel-rt-livepatch-develUpgrade dtb-nvidiaUpgrade kernel-default-optionalUpgrade dlm-kmp-defaultUpgrade dtb-armUpgrade kernel-64kb-extraUpgrade cluster-md-kmp-64kbUpgrade dtb-rockchipUpgrade gfs2-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade kernel-azureUpgrade kernel-azure-develUpgrade kernel-default-baseUpgrade kernel-develUpgrade kernel-rt-extraUpgrade dtb-mediatekUpgrade kernel-default-livepatch-develUpgrade kernel-rt-vdsoUpgrade cluster-md-kmp-defaultUpgrade dtb-qcomUpgrade dtb-sprdUpgrade dtb-xilinxUpgrade reiserfs-kmp-rtUpgrade kernel-debug-vdsoUpgrade kselftests-kmp-rtUpgrade dlm-kmp-rtUpgrade kernel-64kbUpgrade ocfs2-kmp-defaultUpgrade kernel-debug-develUpgrade dtb-exynosUpgrade kernel-source-rtUpgrade dtb-amazonUpgrade kselftests-kmp-azureUpgrade kernel-symsUpgrade kernel-source-azureUpgrade kernel-rt_debugUpgrade kernel-kvmsmallUpgrade dtb-socionextUpgrade dtb-allwinnerUpgrade kernel-azure-optionalUpgrade dtb-amdUpgrade gfs2-kmp-64kbUpgrade dtb-marvellUpgrade dtb-hisiliconUpgrade ocfs2-kmp-64kbUpgrade kernel-64kb-develUpgrade dtb-renesasUpgrade dtb-caviumUpgrade kernel-sourceUpgrade kernel-default-extraUpgrade kernel-kvmsmall-vdsoUpgrade kernel-64kb-optionalUpgrade dtb-alteraUpgrade dlm-kmp-64kbUpgrade ocfs2-kmp-azureUpgrade kernel-zfcpdumpUpgrade kernel-macrosUpgrade kernel-devel-azureUpgrade kernel-debugUpgrade ocfs2-kmp-rtUpgrade kernel-syms-azureUpgrade kernel-docs-htmlUpgrade kernel-default-vdsoUpgrade dtb-freescaleUpgrade kernel-obs-qaUpgrade dtb-broadcomUpgrade dtb-appleUpgrade cluster-md-kmp-azureUpgrade reiserfs-kmp-64kbUpgrade kernel-default-develUpgrade kernel-rt_debug-develUpgrade dtb-apmUpgrade dtb-amlogicUpgrade kernel-kvmsmall-develUpgrade kernel-default-livepatchUpgrade kernel-azure-vdsoUpgrade kernel-azure-extraUpgrade gfs2-kmp-rtUpgrade gfs2-kmp-azureUpgrade kernel-rt-optionalUpgrade dtb-lgUpgrade reiserfs-kmp-defaultUpgrade kselftests-kmp-64kb | Dec 5, 2025 | Aug 18, 2025 |
| Ubuntu | — | No solution exists | Jul 9, 2025 | Jul 4, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub