A use‑after‑free flaw exists in the Nouveau DRM driver of the Linux kernel. The driver destroys a scheduler object with a simple kfree while a fence still references the scheduler’s base structure. When the fence is exported to userspace and a user calls get_timeline_name() through the SYNC_IOC_FILE_INFO ioctl, the kernel dereferences the freed scheduler pointer, triggering a KASAN slab‑use‑after‑free read that can leak kernel data such as the scheduler name. The flaw does not provide direct code execution.

The vulnerability is present in any Linux kernel build that includes the Nouveau DRM driver for NVIDIA GPUs. No specific kernel versions are listed, so all kernels containing the vulnerable code before the patch that replaces kfree with kfree_rcu may be affected. Unprivileged users on such systems can trigger the flaw via normal sync object interfaces.

The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, indicating no current evidence of in‑the‑wild exploitation. However, the flaw can be triggered locally by an unprivileged user who can create or access sync objects. The resulting KASAN violations or kernel crashes could provide information disclosure and serve as a foothold for further local attacks, but no proven exploit chain is known.