CVE-2026-98156
Received Received - Intake

Memory Corruption in Linux Kernel via Virtio GPU

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use the DMA API for resource backing on Xen On a Xen PV domain page addresses bear no relation to the real machine addresses the host would have to use to reach it. virtio_ring.c handles this correctly, vring_use_map_api() returns true for any xen_domain() regardless of VIRTIO_F_ACCESS_PLATFORM. virtio-gpu makes the same decision independently, but its copy looks only at the feature bit: bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev); QEMU does not set iommu_platform on virtio-vga by default, so VIRTIO_F_ACCESS_PLATFORM is not negotiated, use_dma_api is false, and virtio_gpu_object_shmem_init() describes the framebuffer's backing pages to the host with sg_phys(). Those are guest-physical addresses. In a PV domain they resolve, on the host side, to pages belonging to some other domain, so the host scans out unrelated memory. Move the decision into virtio_gpu_use_dma_api() and give it the xen_domain() check, like vring_use_map_api() has. This additionally enables the dma_sync_sgtable_for_device() calls in virtgpu_vq.c, which are required for correctness whenever swiotlb is in play. Reproduced with a Xen 4.21 PV dom0 nested inside QEMU 8.2 with virtio-vga, on both a distro 6.8 kernel and 6.18 LTS. A PVH dom0 works fine and doesn't need this fix because it is identity-mapped, only PV dom0s are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98156
EUVD
EUVD-2026-86987

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
linux kernel From 6.8 (inc) to 6.18 (inc)
qemu qemu 8.2
virtio virtio_gpu *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Linux kernel's handling of virtio-gpu resources in Xen PV domains. The issue occurs because virtio-gpu incorrectly uses guest-physical addresses instead of real machine addresses when sharing framebuffer memory with the host. This happens when QEMU does not set the iommu_platform flag, preventing proper DMA API usage. As a result, the host may scan out unrelated memory belonging to other domains.

Detection Guidance

This vulnerability affects Linux kernels running on Xen PV domains with virtio-gpu. Detection requires checking kernel version, Xen domain type, and virtio-gpu configuration. No direct commands are provided in the context, but you should verify if your system is a Xen PV domain and uses virtio-gpu without DMA API enabled.

Impact Analysis

If you use a Xen PV domain with QEMU and virtio-vga, this vulnerability could allow the host to access or display memory from other virtual machines. This could lead to data leaks, unauthorized access to sensitive information, or system instability. Only PV domains are affected; PVH domains are not impacted.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by enabling unauthorized access to sensitive data through memory exposure. Organizations using Xen PV domains with virtio-gpu may face compliance risks due to potential data leaks or breaches.

Mitigation Strategies

Upgrade to a patched kernel version that includes the fix for this issue. Ensure QEMU sets iommu_platform for virtio-vga to enable VIRTIO_F_ACCESS_PLATFORM. Migrate from Xen PV to PVH dom0 if possible, as PVH is not affected by this vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98156. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart