What’s Vulnerable › Vulnerabilities

CVE-2025-39679: drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor().

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-05 · updated 2026-10-19
• Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). When the nvif_vmm_type is invalid, we will return error directly without freeing the args in nvif_vmm_ctor(), which leading a memory leak. Fix it by setting the ret -EINVAL and goto done.

Affected products

• Linux kernel: from 6.6 before 6.6.103; from 6.7 before 6.12.44; from 6.13 before 6.16.4; 6.17-rc1, 6.17-rc2 — fixed in 6.12.44, 6.16.4, 6.6.103

How to fix

Upgrade to a fixed version: Linux kernel 6.12.44, 6.16.4, 6.6.103. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/72553fe19317fe93cb8591c83095c446bc7fe292
• https://git.kernel.org/stable/c/7d9110e3b35d08832661da1a1fc2d24455981a04
• https://git.kernel.org/stable/c/bb8aeaa3191b617c6faf8ae937252e059673b7ea
• https://git.kernel.org/stable/c/cabcb52d76d3d42f16c344a96e098dd9d18602f8

Get alerted when CVE-2025-39679 or the next vulnerability affects your stack