Security readout for executives and security teams
Plain-English summary
A local, low-privileged user may be able to bypass a Nouveau graphics-driver bounds check because a large offset can wrap to a small value. The supplied CVSS assessment indicates potential compromise of confidentiality, integrity, and availability. This is not described as remotely exploitable.
Executive priority
Treat as a high-priority local privilege-boundary issue, especially on shared workstations, rendering hosts, and multi-tenant systems using Nouveau. It warrants prompt patch validation, but the available evidence does not support emergency internet-wide incident response.
Technical view
In nouveau_gem_pushbuf_reloc_apply(), adding 4 to the 32-bit reloc_bo_offset can overflow before comparison with the buffer object's size. The wrapped result may incorrectly pass validation. The Linux stable fix performs the addition using 64-bit arithmetic.
Likely exposure
Exposure is most likely on Linux systems using the Nouveau DRM driver where untrusted local users or workloads can access the affected graphics interface. The bundle does not provide sufficient distribution package ranges to identify vulnerable installations solely by kernel version.
Exploitation context
The CVSS vector requires local access and low privileges, without user interaction. The supplied record is not in CISA KEV, and the sources provide no evidence of active exploitation or a public exploit. Internet exposure alone does not establish reachability.
Researcher notes
The defect is a 32-bit unsigned addition wrap in a relocation bounds check. The fix casts the calculation to 64 bits. Exact affected distribution builds, practical exploitability, and exploitation in the wild are not established by the supplied bundle; validate against vendor backports rather than version strings alone.
Mitigation direction
- Install a distribution kernel containing the applicable upstream stable fix.
- Confirm the corrected package and reboot requirements through Linux distribution guidance.
- Prioritize multi-user systems running Nouveau with untrusted local workloads.
- If updates are delayed, obtain vendor-approved exposure-reduction guidance.
Validation and detection
- Identify systems where the Nouveau kernel module is present and active.
- Record running kernel and distribution package versions.
- Map each package to the vendor advisory or applicable stable fix.
- Confirm the remediated kernel is running after maintenance.
- Review local telemetry for unexplained GPU-driver crashes without treating them as proof of exploitation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-46006 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3429275684f4bad42876955301f3c5c814aae909CVE reference, Linux
- https://git.kernel.org/stable/c/573a1104bd36e49c067a9dc62e7c476d5ee7e92aCVE reference, Linux
- https://git.kernel.org/stable/c/45a45184b9c0b0b26ead06e370cda2073616a7ccCVE reference, Linux
- https://git.kernel.org/stable/c/fa297e919d1680c38ab268ff952b1698dac987f6CVE reference, Linux
- https://git.kernel.org/stable/c/d749a9a0ee4014681487e7ae549901aa8c176637CVE reference, Linux
- https://git.kernel.org/stable/c/332884f5eb79dd60a7162b079d09d39208567a31CVE reference, Linux
- https://git.kernel.org/stable/c/e441d5c23ec644c8d27593db3b8928e8933512a9CVE reference, Linux
- https://git.kernel.org/stable/c/2fc87d37be1b730a149b035f9375fdb8cc5333a5CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.