CVE-2026-68271

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: fix reversed error cleanup order in ucopy functions

nouveauuvmmvmbinducopy() and nouveauexecucopy() place their error cleanup labels in allocation order rather than reverse allocation order. On a umemcpya() failure for insync.s, the goto to errfreeops (or errfreepushs) frees the first allocation and then falls through to errfreeins, which calls ufree() on args->insync.s.

Since args->insync.s still holds the ERRPTR returned by the failed umemcpya(), and ERRPTR values are not caught by ZEROORNULLPTR(), kvfree() proceeds to dereference it, which can result in a kernel oops. A failure for outsync.s instead jumps to errfreeins and skips freeing the first allocation, leading to a memory leak.

Fix by swapping the cleanup label order so resources are freed in the correct reverse allocation sequence.