---
cve: "CVE-2026-89800"
severity: "LOW"
cvss: 3.1
epss: "0.2%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-09-16 11:16:44"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-20T20:05:44+02:00"
---

# CVE-2026-89800

> 3.1 LOW

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE

A successful OP_UNMAP_SPARSE marks its region dirty with
nouveau_uvma_region_dirty() and defers the teardown to
nouveau_uvmm_bind_job_cleanup(); it does not remove the region from
uvmm->region_mt.

If a later op in the job fails, the unwind path never clears reg->dirty
(set in one place, cleared nowhere) and sets op->reg = NULL, so cleanup
skips the teardown. The region is left in the tree with dirty set and its
completion never signalled. Later binds over that range then fail
permanently -- -ENOENT or -EINVAL from the dirty checks, or an unkillable
wait_for_completion() in bind_validate_region() -- for the lifetime of
the uvmm.

Clear reg->dirty when the unwind reverts the sparse unmap, restoring the
region to the state it was found in.

## Patch verfügbar (OSV)

- Kernel ≥ 6.6.157
- Kernel ≥ 6.12.110
- Kernel ≥ 6.18.51
- Kernel ≥ 7.2.5

## Referenzen

- <https://git.kernel.org/stable/c/a129b2b875c148aba233ace8447a0c36ca3bae07>
- <https://git.kernel.org/stable/c/196ce9e5e93202da097062be24e404984dbc5ac2>
- <https://git.kernel.org/stable/c/1101cbfe7f342e5eaaf7444965d4f1215abdac4c>
- <https://git.kernel.org/stable/c/c60033c172420179b7bbb3d1f843f8dc90164dc5>
- <https://git.kernel.org/stable/c/38a62306c4266bcb3cd89e33c7111ee33096ebb3>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-89800) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_