CVE-2026-52904

Source
https://cve.org/CVERecord?id=CVE-2026-52904
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-52904.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-52904
Downstream
Related
Published
2026-06-09T12:36:01.237Z
Modified
2026-06-18T03:55:38.119628906Z
Summary
drm/nouveau: fix nvkm_device leak on aperture removal failure
Details

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: fix nvkm_device leak on aperture removal failure

When apertureremoveconflictingpcidevices() fails during probe, the error path returns directly without unwinding the nvkmdevice that was just allocated by nvkmdevicepcinew(). This leaks both the device wrapper and the pcienabledevice() reference taken inside it.

Jump to the existing failnvkm label so nvkmdevicedel() runs and balances both. The leak was introduced when the intermediate nvkmdevice_del() between detection and aperture removal was dropped in favor of creating the pci device once.

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52904.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
c0bfe34330b5fafdbbc63a7124841711651b96b9
Fixed
5edd564ccb002ffc830e7818c1c4a992db774678
Fixed
4404d7d2dda4f3cc84a8fb6ac5417a2afc3b22d6
Fixed
843c0247cf21364e33bb5a8ffc9af57107d04d05
Fixed
6597ff1d8de3f583be169587efeafd8af134e138

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-52904.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.12.0
Fixed
6.12.86
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.27
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.0.4

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-52904.json"