Bug 2559573 (CVE-2026-98875)

Summary:	CVE-2026-98875 kernel: drm/nouveau/gsp: add SEC2 to GA100 chip table
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's Nouveau GPU driver. During graphics hardware initialization on systems with GA100 chipsets, the driver fails to properly configure an internal security processor entry, leaving a required pointer uninitialized. A local user or process interacting with the graphics driver can trigger a null pointer dereference, crashing the kernel and resulting in a Denial of Service (DoS).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-23 12:05:06 UTC

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau/gsp: add SEC2 to GA100 chip table

The booter-load and booter-unload firmware run on the SEC2 falcon.
During tu102_gsp_oneinit(), the booter constructor needs device->sec2
to access the SEC2 falcon.

Without the .sec2 entry, device->sec2 is NULL and this dereference
crashes during GSP-RM boot.

Comment 1 Mauro Matteo Cascella 2026-10-26 10:32:13 UTC

Upstream advisory:
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98875.mbox