In the Linux kernel’s DRM Nouveau driver, the functions nouveau_uvmm_vm_bind_ucopy() and nouveau_exec_ucopy() incorrectly order cleanup labels during error handling. When a u_memcpya() call fails for the in_sync.s buffer, the cleanup frees a memory allocation prematurely and then attempts to free a pointer that contains an ERR_PTR value. The kernel’s kvfree dereferences this erroneous pointer, leading to a kernel oops and system crash. A failure on the out_sync.s buffer similarly results in a memory leak due to missing cleanup. This bug allows a crash that can affect the entire system, representing a denial‑of‑service flaw.

The vulnerability exists in the Linux kernel’s DRM Nouveau subsystem. The affected vendor is Linux (kernel) across all current releases that contain the buggy code. No specific version range is provided in the data, so all kernel releases prior to the patch are potentially impacted.

The risk manifested is a kernel oops that can shut down the system, constituting a denial‑of‑service condition. Because the flaw is within the kernel module, exploitation would require an attacker to trigger a failure in the ucopy operation, typically through graphics subsystem activity. The likely attack vector is through a graphics operation that exercises the Nouveau driver, which would cause a u_memcpya failure. Based on the description, it is inferred that an attacker would need to trigger an error in the ucopy operation, which likely involves performing graphics operations that exercise the Nouveau driver. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating at present no known widespread exploitation. Nonetheless, the potential for a crash warrants immediate action once a patched kernel is available.