There is a flaw reported in the Linux kernel in versions before 5.9 in
drivers/gpu/drm/nouveau/nouveau_sgdma.c in nouveau_sgdma_create_ttm in
Nouveau DRM subsystem. The issue results from the lack of validating the
existence of an object prior to performing operations on the object. An
attacker with a local account with a root privilege, can leverage this
vulnerability to escalate privileges and execute code in the context of the
kernel.

It was discovered that the DRM subsystem in the Linux kernel contained
double-free vulnerabilities. A privileged attacker could possibly use this
to cause a denial of service (system crash) or possibly execute arbitrary
code.

sbeattie

kernels with CONFIG_SLAB_FREELIST_HARDENED=y (which Ubuntu enables) are probably not affected.