CVE-2026-89802

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op

Each bind_job_op is zeroed by kzalloc_obj() in bind_job_op_from_uop(),

and the OP_MAP_SPARSE case in nouveau_uvmm_bind_job_submit() only creates

a region, so op->ops stays NULL for a successfully processed sparse map.

If a later op in the same job fails, the reverse unwind loop revisits that

op and calls drm_gpuva_ops_free(&uvmm->base, op->ops) unconditionally.

drm_gpuva_ops_free() dereferences its argument right away

(list_for_each_entry_safe on &ops->list), so a NULL op->ops oopses. The

path is reachable by any render-node fd holder, since NOUVEAU_VM_BIND is

DRM_RENDER_ALLOW.

Guard the free with IS_ERR_OR_NULL(), as nouveau_uvmm_bind_job_cleanup()

already does for the identical free.