Linux Kernel Use-After-Free Vulnerability in Nouveau DRM Component

A use-after-free vulnerability has been fixed in the Linux kernel's Nouveau Direct Rendering Manager (DRM) component. The issue arises in the function r535_gsp_rpc_push(), where the RPC container is released after being sent to r535_gsp_rpc_send(). This premature release can lead to a use-after-free condition when the initial fragment of a large RPC is sent, causing subsequent fragments to attempt to access a freed container. The vulnerability has been addressed by allocating a temporary RPC container for the initial fragment and ensuring the caller's container is only freed after all fragments have been successfully sent.

Impact

Exploitation of this vulnerability could lead to a use-after-free condition, potentially allowing for arbitrary code execution or memory corruption.