CVE-2026-68271

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/nouveau: fix reversed error cleanup order in ucopy functions<br /> <br /> nouveau_uvmm_vm_bind_ucopy() and nouveau_exec_ucopy() place their error<br /> cleanup labels in allocation order rather than reverse allocation order.<br /> On a u_memcpya() failure for in_sync.s, the goto to err_free_ops (or<br /> err_free_pushs) frees the first allocation and then falls through to<br /> err_free_ins, which calls u_free() on args-&gt;in_sync.s.<br /> <br /> Since args-&gt;in_sync.s still holds the ERR_PTR returned by the failed<br /> u_memcpya(), and ERR_PTR values are not caught by ZERO_OR_NULL_PTR(),<br /> kvfree() proceeds to dereference it, which can result in a kernel oops.<br /> A failure for out_sync.s instead jumps to err_free_ins and skips freeing<br /> the first allocation, leading to a memory leak.<br /> <br /> Fix by swapping the cleanup label order so resources are freed in the<br /> correct reverse allocation sequence.