A double‑free bug in the Nouveau driver’s nvif_vmm_dtor routine allows the same memory region to be freed twice during cleanup after a failed client initialization. Susceptible kernel code repeatedly calls nouveau_cli_fini() and nouveau_vmm_fini(), leading to a double free that can corrupt the kernel’s heap. This type of memory corruption can potentially be leveraged by an attacker to crash the system or achieve code execution with kernel privileges.

The vulnerability exists in the Linux kernel’s Nouveau GPU driver, which is shipped as part of the default kernel package on all distributions that use the open‑source driver. All kernel releases prior to the fix (the exact kernel version range is not specified) are affected. The issue would manifest on any system that loads the nouveau module and performs open or close operations on a GPU device.

The CVSS score is not provided and EPSS is unavailable, so the quantitative risk cannot be precisely quantified from the available data. The bug is present in kernel land and would require local access to the system’s driver interfaces to trigger. Because double frees can potentially lead to arbitrary code execution, the risk is considered significant, although the possibility of exploitation depends on an attacker’s ability to control allocation and memory layout. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed external exploitation at present. Nonetheless, the potential for kernel privilege escalation or denial of service warrants immediate remediation.