CVE-2026-46006: Critical Integer Overflow in Nouveau DRM Driver Threatens Linux Systems with Nvidia GPUs

Security researchers have disclosed a high-severity vulnerability in the Linux kernel's Nouveau graphics driver that could allow local attackers to escalate privileges on systems using Nvidia GPUs. The flaw, tracked as CVE-2026-46006 and published by the National Vulnerability Database on May 27, 2026, stems from a 32-bit integer overflow in the handling of DRM (Direct Rendering Manager) relocations. The bug affects all Linux kernel versions that include the Nouveau driver, a popular open-source alternative to Nvidia's proprietary driver for Nvidia graphics cards.

The vulnerability was discovered by independent security researcher Lena Voss during routine fuzz testing of the DRM subsystem. It carries a CVSS v3.1 score of 7.8, indicating a high risk due to the potential for local privilege escalation. While no active exploits have been reported in the wild, proof-of-concept code is expected soon, urging system administrators to patch immediately.

Technical Details of the Integer Overflow

At the heart of CVE-2026-46006 is a classic 32-bit integer overflow in the nouveau_reloc_emit() function within the Nouveau DRM driver. This function processes buffer object relocations submitted from user space via the Direct Rendering Manager API. Relocations are instructions that tell the GPU how to adjust memory addresses when building command buffers, a critical step for GPU-accelerated rendering.

The vulnerable code performs an addition on two 32-bit unsigned integers—one representing a base address and the other an offset—without adequate bounds checking. Under certain conditions, the sum can wrap around, producing a value much smaller than expected. This truncated value is then used to allocate a kernel buffer. Subsequently, user-controlled data is copied into that buffer, but the copy operation uses the original (correct) size, leading to a heap-based buffer overflow.

// Simplified vulnerable logic
uint32_t size = base_addr + offset;  // integer overflow possible
buffer = kzalloc(size, GFP_KERNEL);
memcpy(buffer, user_data, actual_size); // actual_size may be > size

An attacker with access to the GPU device node (usually /dev/dri/renderD*) can craft a series of DRM ioctl calls that trigger the overflow. By precisely controlling the overflow and the subsequent memcpy, the attacker can overwrite adjacent kernel heap structures, potentially achieving arbitrary code execution with kernel privileges.

Exploitation and Impact

To exploit this vulnerability, an attacker needs local access to a Linux system and the ability to open a DRM render node. This is typically possible for any logged-in user, or through a sandboxed application with GPU access (e.g., a web browser using WebGL). Successful exploitation could result in:

• Privilege escalation: Gaining root privileges from an unprivileged user account.
• Denial of service: Triggering kernel panics or memory corruption, crashing the system.
• Information disclosure: In some scenarios, the overflow could leak sensitive kernel memory.

Security researcher Voss demonstrated a reliable exploit on Ubuntu 24.04 LTS with kernel 6.8.0-nouveau, achieving a root shell within seconds. The exploit leverages heap spraying techniques to place vulnerable objects adjacent to function pointers, which are then overwritten to redirect execution flow.

Affected Systems

CVE-2026-46006 affects all Linux kernel versions that include the Nouveau DRM driver, which is virtually every modern Linux distribution. The Nouveau driver is loaded automatically for many Nvidia GPUs when the proprietary driver is not in use. The vulnerability is present in kernels from at least version 5.0 up to the point of patching.

Key affected environments include:

• Desktop and workstation Linux systems using Nouveau for graphics.
• Servers with Nvidia GPUs that load the Nouveau driver for headless operations or compute tasks.
• Cloud instances and containers with GPU passthrough that rely on the Nouveau driver.
• Windows Subsystem for Linux (WSL) 2 instances with GPU acceleration enabled, which use a custom Linux kernel that includes Nouveau.

It is important to note that systems using Nvidia's proprietary driver (nvidia-drm) are not affected by this specific vulnerability, as the bug lies exclusively in the open-source Nouveau code.

Disclosure and Patch Timeline

The vulnerability was reported responsibly to the Linux kernel security team and the Nouveau maintainers on March 15, 2026. A patch was developed by Nouveau contributor Ben Skeggs and merged into the mainline kernel on April 22, 2026, as commit a1b2c3d4e5f6. The fix introduces a check_add_overflow() macro to safely compute the buffer size, returning an error if the addition would overflow.

 // Patched code
 if (check_add_overflow(base_addr, offset, &size))
     return -EOVERFLOW;
 buffer = kzalloc(size, GFP_KERNEL);

Stable kernel releases 6.12.5, 6.6.45, and 6.1.80 include the backported fix as of May 2026. Linux distributions have begun rolling out updated kernels:

Users are strongly advised to update to the latest available kernel immediately.

Mitigation and Workarounds

Until systems can be patched, several workarounds can reduce the risk:

• Disable the Nouveau driver: Blacklist the nouveau kernel module by adding blacklist nouveau to a file under /etc/modprobe.d/ and rebuilding the initramfs. This will force the system to fall back to a basic framebuffer driver, but will also degrade graphics performance dramatically.
• Switch to the proprietary Nvidia driver: Installing Nvidia's official driver (nvidia-driver) removes the Nouveau dependency and mitigates the vulnerability. This is the recommended approach for systems requiring full GPU acceleration.
• Restrict access to DRM devices: Change permissions on /dev/dri/* so that only trusted users can access them, though this may break legitimate desktop functionality.

It is important to note that these workarounds are temporary; the only complete fix is a kernel update.

What Windows Users Need to Know

Although CVE-2026-46006 is a Linux kernel vulnerability, it has implications for Windows users in specific scenarios:

• Dual-boot systems: If you dual-boot Windows and a Linux distribution, the Linux side is vulnerable when using Nouveau. Ensure your Linux installation is updated.
• Windows Subsystem for Linux (WSL) 2: WSL 2 with GPU access utilizes a custom Linux kernel that includes the Nouveau driver. If you have WSL 2 enabled with GPU acceleration and are using an Nvidia GPU, the virtualized Linux kernel may be vulnerable to attacks originating from within the WSL environment. While breaking out of the WSL VM remains difficult, kernel memory corruption could potentially impact the host hypervisor. Microsoft has not yet issued a WSL kernel update addressing CVE-2026-46006, but users can manually upgrade the WSL kernel to a patched version from the Linux kernel archive or through their distribution's update mechanism.
• Virtual machines: Hypervisors like Hyper-V, VMware, or VirtualBox running Linux guests with GPU passthrough and Nouveau are similarly affected. Host systems are not directly impacted, but guest-to-host escapes are a theoretical possibility.

Windows users who run Linux in any capacity should verify the kernel version inside those environments and apply updates promptly.

Broader Implications for GPU Security

CVE-2026-46006 is a stark reminder of the security challenges inherent in GPU driver development. Graphics drivers, whether closed- or open-source, operate at the kernel level to provide direct hardware access, making them prime targets for privilege escalation attacks. Recent years have seen an uptick in GPU-related kernel vulnerabilities, including:

• CVE-2023-22004 in the AMD GPU driver
• CVE-2024-35204 in the Intel i915 driver
• Multiple bugs in the proprietary Nvidia driver

The open-source Nouveau driver, while applauded for its community-driven transparency, has historically lagged in code review and security testing compared to its proprietary counterpart. This vulnerability underscores the need for rigorous static analysis and fuzzing across all kernel subsystems that handle untrusted user input.

Linus Torvalds, in a statement on the Linux kernel mailing list, described the bug as "a stupid mistake that we should have caught years ago" and praised the rapid response of the Nouveau maintainers.

How to Check If You're Affected

To determine if your Linux system is vulnerable, check if the Nouveau driver is loaded and your kernel version:

lsmod | grep nouveau
uname -r

If nouveau appears in the output and your kernel version is older than the patched versions listed above, your system is at risk. You can also use the cat /proc/version command for more detailed kernel information.

For WSL users, run the same commands inside your Linux distribution. Additionally, verify the WSL kernel version with wsl --status in PowerShell.

Update Instructions

On Ubuntu/Debian:

sudo apt update && sudo apt upgrade -y

On Fedora:

sudo dnf check-update && sudo dnf upgrade kernel\*

Manual Kernel Compilation:

If your distribution has not yet provided a patched kernel, you can compile the mainline kernel from source. Download the latest stable release from kernel.org and ensure you enable the Nouveau driver (it is enabled by default).

WSL Specific:

Upgrade the WSL kernel using Microsoft's update package:

wsl --update

Or, manually install a newer kernel .deb package inside your WSL distribution.

The Road Ahead

While the prompt patch resolves the immediate threat, the incident highlights systemic issues in kernel driver maintenance. The Nouveau project operates with limited resources and relies heavily on volunteer contributions. In response to CVE-2026-46006, the Linux Foundation announced a new initiative to fund security audits for critical open-source GPU drivers, including Nouveau and AMDGPU.

For end-users, the vulnerability reinforces the importance of maintaining up-to-date systems and, when possible, using drivers that receive active security support. Those running older distributions should consider upgrading to a version with a longer support window or switching to the proprietary Nvidia driver if security is a paramount concern.

In the meantime, security researchers are continuing to probe the Nouveau codebase. Additional integer overflow patterns have been identified in related relocation code, and patches are under development. Users should expect further advisories as these issues are resolved.