Kernel oops: NULL pointer dereference in os_get_euid

### NVIDIA Open GPU Kernel Modules Version 610.43.02 ### Please confirm this issue does not happen with the proprietary driver (of the same version). This issue tracker is only for bugs specific to the open kernel driver. - [x] I confirm that this does not happen with the proprietary driver package. ### Operating System and Version Gentoo Linux ### Kernel Release Linux bera-gentoo 7.1.1-gentoo #3 SMP PREEMPT_DYNAMIC Sat Jun 27 11:07:24 +03 2026 x86_64 AMD Ryzen 5 8645HS w/ Radeon 760M Graphics AuthenticAMD GNU/Linux ### Please confirm you are running a stable release kernel (e.g. not a -rc). We do not accept bug reports for unreleased kernels. - [x] I am running on a stable kernel release. ### Hardware: GPU VGA compatible controller [0300]: NVIDIA Corporation AD107M [GeForce RTX 4060 Max-Q / Mobile] [10de:28e0] (rev a1) ### Describe the bug I runned: $ sudo modprobe -C /dev/null nvidia $ sway then screen freezed. nvidia: loading out-of-tree module taints kernel. nvidia-nvlink: Nvlink Core is being initialized, major device number 236 nvidia 0000:01:00.0: enabling device (0000 -> 0003) nvidia 0000:01:00.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=none:owns=none NVRM: loading NVIDIA UNIX Open Kernel Module for x86_64 610.43.02 Release Build (portage@localhost) Sat Jun 20 16:44:01 +03 2026 BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP CPU: 6 UID: 1000 PID: 704 Comm: sway Tainted: G O 7.1.1-gentoo #3 PREEMPT(lazy) Tainted: [O]=OOT_MODULE Hardware name: LENOVO 83DX/LNVNB161216, BIOS NZCN29WW 09/18/2025 RIP: 0010:os_get_euid+0x18/0x30 [nvidia] Code: 2e f0 0f 1f 40 d6 0f 1f 44 00 00 31 c0 e9 cb 8f 2e f0 0f 1f 40 d6 0f 1f 44 00 00 65 48 8b 05 cf 0e bf f2 48 8b 80 38 0c 00 00 <8b> 40 18 89 07 31 c0 e9 a7 8f 2e f0 90 66 66 2e 0f 1f 84 00 00 00 RSP: 0018:ffffd09900e1f788 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff8ce641e54888 RCX: 00000000000000df RDX: ffff8ce641e54888 RSI: 0000000000000000 RDI: ffff8ce641e54888 RBP: ffffd09900e1f7a0 R08: 0000000000000000 R09: ffff8ce641e54880 R10: ffff8ce641e54880 R11: 0000000000000000 R12: 0000000000000000 R13: ffffd09900e1faa8 R14: ffffd09900e1fa88 R15: 0000000000000001 FS: 00007f7848440f80(0000) GS:ffff8ce7c110b000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000018 CR3: 0000000111fe3000 CR4: 0000000000f50ef0 PKRU: 55555554 Call Trace: <TASK> osGetSecurityToken+0x27/0x60 [nvidia] rmclientConstruct_IMPL+0x625/0x6a0 [nvidia] ? srso_alias_return_thunk+0x5/0xfbef5 ? clientConstruct_IMPL+0x56/0xa0 [nvidia] ? __nvoc_ctor_RsClient+0x4e/0x70 [nvidia] ? srso_alias_return_thunk+0x5/0xfbef5 __nvoc_objCreate_RmClient+0xf1/0x270 [nvidia] resservClientFactory+0x23/0x80 [nvidia] ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? portThreadGetCurrentThreadId+0x1d/0x1f0 [nvidia] ? srso_alias_return_thunk+0x5/0xfbef5 serverAllocClient+0x2c8/0x470 [nvidia] serverAllocResource+0x3bb/0x5c0 [nvidia] ? srso_alias_return_thunk+0x5/0xfbef5 rmapiAllocWithSecInfo+0x207/0x470 [nvidia] ? srso_alias_return_thunk+0x5/0xfbef5 rmapiAllocWithSecInfoTls+0x75/0xa0 [nvidia] ? srso_alias_return_thunk+0x5/0xfbef5 Nv04AllocWithAccessSecInfo+0x69/0x80 [nvidia] ? security_capable+0x50/0x150 RmIoctl+0xab2/0xe40 [nvidia] ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? os_get_monotonic_time_ns+0x2d/0x90 [nvidia] ? os_acquire_spinlock+0x12/0x30 [nvidia] ? srso_alias_return_thunk+0x5/0xfbef5 ? portSyncSpinlockAcquire+0x18/0x30 [nvidia] ? srso_alias_return_thunk+0x5/0xfbef5 rm_ioctl+0x7f/0x600 [nvidia] nvidia_dev_put+0xaaf/0xe70 [nvidia] ? srso_alias_return_thunk+0x5/0xfbef5 ? __x64_sys_close+0x47/0xa0 nvidia_dev_put+0xe5d/0xe70 [nvidia] __x64_sys_ioctl+0xb9/0x100 ? do_syscall_64+0x11f/0x950 do_syscall_64+0xe2/0x950 ? do_syscall_64+0x99/0x950 ? exc_page_fault+0x90/0x1f0 entry_SYSCALL_64_after_hwframe+0x55/0x5d RIP: 0033:0x7f7848ed445f Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 18 48 8b 44 24 18 64 48 2b 04 25 28 00 00 RSP: 002b:00007ffff95ec2b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000030 RCX: 00007f7848ed445f RDX: 00007ffff95ec4f0 RSI: 00000000c030462b RDI: 000000000000000d RBP: 00007ffff95ec4f0 R08: 00007ffff95ec4f0 R09: 00007ffff95ec518 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000d R13: 00000000c030462b R14: 000000000000002b R15: 00007ffff95ec310 </TASK> Modules linked in: nvidia(O) amdgpu mt7921e mt7921_common mt792x_lib mt76_connac_lib mt76 snd_sof_amd_acp70 snd_sof_amd_acp63 snd_sof_amd_vangogh snd_sof_amd_rembrandt snd_sof_amd_renoir mac80211 snd_sof_amd_acp snd_sof_pci snd_sof_xtensa_dsp snd_sof snd_sof_utils amd_atl snd_pci_ps snd_soc_acpi_amd_match snd_ctl_led snd_soc_acpi_amd_sdca_quirks kvm_amd snd_soc_sdca snd_hda_codec_alc269 drm_client_lib snd_hda_scodec_component i2c_algo_bit snd_hda_codec_realtek_lib drm_buddy snd_hda_codec_nvhdmi drm_ttm_helper libarc4 snd_hda_codec_generic snd_hda_codec_hdmi ttm snd_soc_core kvm cfg80211 snd_hda_intel drm_exec drm_suballoc_helper snd_hda_codec gpu_sched snd_compress drm_panel_backlight_quirks snd_acp_pci amdxcp snd_hwdep snd_amd_acpi_mach drm_display_helper snd_hda_core snd_acp_legacy_common snd_pci_acp6x snd_intel_dspcfg snd_intel_sdw_acpi ucsi_acpi snd_pci_acp5x drm_kms_helper typec_ucsi snd_pcm snd_rn_pci_acp3x spd5118 snd_acp_config typec sp5100_tco snd_timer ideapad_laptop vfat hid_multitouch snd_soc_acpi fat irqbypass rapl sparse_keymap pcspkr snd wmi_bmof cec snd_pci_acp3x thunderbolt rfkill i2c_hid_acpi soundcore i2c_piix4 i2c_hid i2c_smbus k10temp amd_pmc serio_raw binfmt_misc CR2: 0000000000000018 ---[ end trace 0000000000000000 ]--- RIP: 0010:os_get_euid+0x18/0x30 [nvidia] Code: 2e f0 0f 1f 40 d6 0f 1f 44 00 00 31 c0 e9 cb 8f 2e f0 0f 1f 40 d6 0f 1f 44 00 00 65 48 8b 05 cf 0e bf f2 48 8b 80 38 0c 00 00 <8b> 40 18 89 07 31 c0 e9 a7 8f 2e f0 90 66 66 2e 0f 1f 84 00 00 00 RSP: 0018:ffffd09900e1f788 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff8ce641e54888 RCX: 00000000000000df RDX: ffff8ce641e54888 RSI: 0000000000000000 RDI: ffff8ce641e54888 RBP: ffffd09900e1f7a0 R08: 0000000000000000 R09: ffff8ce641e54880 R10: ffff8ce641e54880 R11: 0000000000000000 R12: 0000000000000000 R13: ffffd09900e1faa8 R14: ffffd09900e1fa88 R15: 0000000000000001 FS: 00007f7848440f80(0000) GS:ffff8ce7c110b000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000018 CR3: 0000000111fe3000 CR4: 0000000000f50ef0 PKRU: 55555554 note: sway[704] exited with irqs disabled NVRM: nvAssertFailedNoLog: Assertion failed: !rmapiLockIsOwner() @ rmapi.c:563 BUG: kernel NULL pointer dereference, address: 0000000000000014 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page ### To Reproduce Boot with the specified kernel, load the driver and then run sway. ### Bug Incidence Always ### nvidia-bug-report.log.gz [nvidia-bug-report.log.gz](https://github.com/user-attachments/files/29406872/nvidia-bug-report.log.gz) ### More Info _No response_