Kernel oops: NULL pointer dereference in os_get_euid

NVIDIA Open GPU Kernel Modules Version

610.43.02

Please confirm this issue does not happen with the proprietary driver (of the same version). This issue tracker is only for bugs specific to the open kernel driver.

• I confirm that this does not happen with the proprietary driver package.

Operating System and Version

Gentoo Linux

Kernel Release

Linux bera-gentoo 7.1.1-gentoo #3 SMP PREEMPT_DYNAMIC Sat Jun 27 11:07:24 +03 2026 x86_64 AMD Ryzen 5 8645HS w/ Radeon 760M Graphics AuthenticAMD GNU/Linux

Please confirm you are running a stable release kernel (e.g. not a -rc). We do not accept bug reports for unreleased kernels.

• I am running on a stable kernel release.

Hardware: GPU

VGA compatible controller [0300]: NVIDIA Corporation AD107M [GeForce RTX 4060 Max-Q / Mobile] [10de:28e0] (rev a1)

Describe the bug

I runned:

$ sudo modprobe -C /dev/null nvidia
$ sway

then screen freezed.

nvidia: loading out-of-tree module taints kernel.
nvidia-nvlink: Nvlink Core is being initialized, major device number 236

nvidia 0000:01:00.0: enabling device (0000 -> 0003)
nvidia 0000:01:00.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=none:owns=none
NVRM: loading NVIDIA UNIX Open Kernel Module for x86_64 610.43.02 Release Build (portage@localhost) Sat Jun 20 16:44:01 +03 2026
BUG: kernel NULL pointer dereference, address: 0000000000000018
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: Oops: 0000 [#1] SMP
CPU: 6 UID: 1000 PID: 704 Comm: sway Tainted: G O 7.1.1-gentoo #3 PREEMPT(lazy)
Tainted: [O]=OOT_MODULE
Hardware name: LENOVO 83DX/LNVNB161216, BIOS NZCN29WW 09/18/2025
RIP: 0010:os_get_euid+0x18/0x30 [nvidia]
Code: 2e f0 0f 1f 40 d6 0f 1f 44 00 00 31 c0 e9 cb 8f 2e f0 0f 1f 40 d6 0f 1f 44 00 00 65 48 8b 05 cf 0e bf f2 48 8b 80 38 0c 00 00 <8b> 40 18 89 07 31 c0 e9 a7 8f 2e f0 90 66 66 2e 0f 1f 84 00 00 00
RSP: 0018:ffffd09900e1f788 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff8ce641e54888 RCX: 00000000000000df
RDX: ffff8ce641e54888 RSI: 0000000000000000 RDI: ffff8ce641e54888
RBP: ffffd09900e1f7a0 R08: 0000000000000000 R09: ffff8ce641e54880
R10: ffff8ce641e54880 R11: 0000000000000000 R12: 0000000000000000
R13: ffffd09900e1faa8 R14: ffffd09900e1fa88 R15: 0000000000000001
FS: 00007f7848440f80(0000) GS:ffff8ce7c110b000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000018 CR3: 0000000111fe3000 CR4: 0000000000f50ef0
PKRU: 55555554
Call Trace:

osGetSecurityToken+0x27/0x60 [nvidia]
rmclientConstruct_IMPL+0x625/0x6a0 [nvidia]
? srso_alias_return_thunk+0x5/0xfbef5
? clientConstruct_IMPL+0x56/0xa0 [nvidia]
? __nvoc_ctor_RsClient+0x4e/0x70 [nvidia]
? srso_alias_return_thunk+0x5/0xfbef5
__nvoc_objCreate_RmClient+0xf1/0x270 [nvidia]
resservClientFactory+0x23/0x80 [nvidia]
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? portThreadGetCurrentThreadId+0x1d/0x1f0 [nvidia]
? srso_alias_return_thunk+0x5/0xfbef5
serverAllocClient+0x2c8/0x470 [nvidia]
serverAllocResource+0x3bb/0x5c0 [nvidia]
? srso_alias_return_thunk+0x5/0xfbef5
rmapiAllocWithSecInfo+0x207/0x470 [nvidia]
? srso_alias_return_thunk+0x5/0xfbef5
rmapiAllocWithSecInfoTls+0x75/0xa0 [nvidia]
? srso_alias_return_thunk+0x5/0xfbef5
Nv04AllocWithAccessSecInfo+0x69/0x80 [nvidia]
? security_capable+0x50/0x150
RmIoctl+0xab2/0xe40 [nvidia]
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? os_get_monotonic_time_ns+0x2d/0x90 [nvidia]
? os_acquire_spinlock+0x12/0x30 [nvidia]
? srso_alias_return_thunk+0x5/0xfbef5
? portSyncSpinlockAcquire+0x18/0x30 [nvidia]
? srso_alias_return_thunk+0x5/0xfbef5
rm_ioctl+0x7f/0x600 [nvidia]
nvidia_dev_put+0xaaf/0xe70 [nvidia]
? srso_alias_return_thunk+0x5/0xfbef5
? __x64_sys_close+0x47/0xa0
nvidia_dev_put+0xe5d/0xe70 [nvidia]
__x64_sys_ioctl+0xb9/0x100
? do_syscall_64+0x11f/0x950
do_syscall_64+0xe2/0x950
? do_syscall_64+0x99/0x950
? exc_page_fault+0x90/0x1f0
entry_SYSCALL_64_after_hwframe+0x55/0x5d
RIP: 0033:0x7f7848ed445f
Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 18 48 8b 44 24 18 64 48 2b 04 25 28 00 00
RSP: 002b:00007ffff95ec2b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000030 RCX: 00007f7848ed445f
RDX: 00007ffff95ec4f0 RSI: 00000000c030462b RDI: 000000000000000d
RBP: 00007ffff95ec4f0 R08: 00007ffff95ec4f0 R09: 00007ffff95ec518
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000d
R13: 00000000c030462b R14: 000000000000002b R15: 00007ffff95ec310

Modules linked in: nvidia(O) amdgpu mt7921e mt7921_common mt792x_lib mt76_connac_lib mt76 snd_sof_amd_acp70 snd_sof_amd_acp63 snd_sof_amd_vangogh snd_sof_amd_rembrandt snd_sof_amd_renoir mac80211 snd_sof_amd_acp snd_sof_pci snd_sof_xtensa_dsp snd_sof snd_sof_utils amd_atl snd_pci_ps snd_soc_acpi_amd_match snd_ctl_led snd_soc_acpi_amd_sdca_quirks kvm_amd snd_soc_sdca snd_hda_codec_alc269 drm_client_lib snd_hda_scodec_component i2c_algo_bit snd_hda_codec_realtek_lib drm_buddy snd_hda_codec_nvhdmi drm_ttm_helper libarc4 snd_hda_codec_generic snd_hda_codec_hdmi ttm snd_soc_core kvm cfg80211 snd_hda_intel drm_exec drm_suballoc_helper snd_hda_codec gpu_sched snd_compress drm_panel_backlight_quirks snd_acp_pci amdxcp snd_hwdep snd_amd_acpi_mach drm_display_helper snd_hda_core snd_acp_legacy_common snd_pci_acp6x snd_intel_dspcfg snd_intel_sdw_acpi ucsi_acpi snd_pci_acp5x drm_kms_helper typec_ucsi snd_pcm snd_rn_pci_acp3x spd5118 snd_acp_config typec sp5100_tco snd_timer ideapad_laptop vfat hid_multitouch
snd_soc_acpi fat irqbypass rapl sparse_keymap pcspkr snd wmi_bmof cec snd_pci_acp3x thunderbolt rfkill i2c_hid_acpi soundcore i2c_piix4 i2c_hid i2c_smbus k10temp amd_pmc serio_raw binfmt_misc
CR2: 0000000000000018
---[ end trace 0000000000000000 ]---
RIP: 0010:os_get_euid+0x18/0x30 [nvidia]
Code: 2e f0 0f 1f 40 d6 0f 1f 44 00 00 31 c0 e9 cb 8f 2e f0 0f 1f 40 d6 0f 1f 44 00 00 65 48 8b 05 cf 0e bf f2 48 8b 80 38 0c 00 00 <8b> 40 18 89 07 31 c0 e9 a7 8f 2e f0 90 66 66 2e 0f 1f 84 00 00 00
RSP: 0018:ffffd09900e1f788 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff8ce641e54888 RCX: 00000000000000df
RDX: ffff8ce641e54888 RSI: 0000000000000000 RDI: ffff8ce641e54888
RBP: ffffd09900e1f7a0 R08: 0000000000000000 R09: ffff8ce641e54880
R10: ffff8ce641e54880 R11: 0000000000000000 R12: 0000000000000000
R13: ffffd09900e1faa8 R14: ffffd09900e1fa88 R15: 0000000000000001
FS: 00007f7848440f80(0000) GS:ffff8ce7c110b000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000018 CR3: 0000000111fe3000 CR4: 0000000000f50ef0
PKRU: 55555554
note: sway[704] exited with irqs disabled
NVRM: nvAssertFailedNoLog: Assertion failed: !rmapiLockIsOwner() @ rmapi.c:563
BUG: kernel NULL pointer dereference, address: 0000000000000014
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page

To Reproduce

Boot with the specified kernel, load the driver and then run sway.

Bug Incidence

Always

nvidia-bug-report.log.gz

nvidia-bug-report.log.gz

More Info

No response

Start by reproducing the crash on the specified Gentoo kernel: load the NVIDIA module and run sway, then inspect the oops at os_get_euid and its osGetSecurityToken/rmclientConstruct_IMPL call path. Review the assertion location in rmapi.c:563 and the attached nvidia-bug-report.log.gz. Done means the reproducible startup path no longer triggers the NULL dereference or follow-on kernel oops.