CVE-2026-98609
Received Received - Intake

Memory Leak in Linux Kernel DRM VirtIO GPU Driver

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak when drm_gem_handle_create() fails virtio_gpu_gem_create() owns the reference taken by virtio_gpu_object_create(). On the drm_gem_handle_create() error path it calls drm_gem_object_release() instead of dropping that reference. drm_gem_object_release() is the inverse of drm_gem_object_init() and does not touch the reference count or call obj->funcs->free(), so it is only correct as the last step of a destructor, as in virtio_gpu_cleanup_object(). Using it here leaves the bo at refcount 1 with no remaining reference, so virtio_gpu_free_object() never runs and the shmem pages, sg table and virtio_gpu_object are leaked. Since virtio_gpu_object_create() has already set bo->created, VIRTIO_GPU_CMD_RESOURCE_UNREF is not queued either, leaking the host-side resource and the resource id. drm_gem_handle_create_tail() drops the handle reference on all of its internal error paths, so the caller only has to drop its own. Use drm_gem_object_put(), matching the success path below.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98609
EUVD
EUVD-2026-103654

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux dc5698e80cf724770283e10414054662bdf6ccfa
Linux Linux dc5698e80cf724770283e10414054662bdf6ccfa
Linux Linux dc5698e80cf724770283e10414054662bdf6ccfa
Linux Linux dc5698e80cf724770283e10414054662bdf6ccfa
Linux Linux dc5698e80cf724770283e10414054662bdf6ccfa
Linux Linux dc5698e80cf724770283e10414054662bdf6ccfa
Linux Linux dc5698e80cf724770283e10414054662bdf6ccfa
Linux Linux dc5698e80cf724770283e10414054662bdf6ccfa
Linux Linux 4.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a memory leak in the VirtIO GPU driver. When drm_gem_handle_create() fails, the function virtio_gpu_gem_create() incorrectly calls drm_gem_object_release() instead of dropping a reference. This leaves an object with a reference count of 1 but no remaining references, preventing proper cleanup. As a result, memory like shmem pages, sg tables, and the virtio_gpu_object itself are leaked, along with host-side resources and resource IDs.

Detection Guidance

This vulnerability is specific to the Linux kernel's DRM/VirtIO GPU driver and requires kernel-level inspection. Detection involves checking kernel logs for GPU-related errors or memory leaks. Use commands like dmesg | grep virtio_gpu or journalctl -k | grep virtio_gpu to search for errors. If you suspect exploitation, monitor for unexpected resource usage or crashes in GPU-related processes.

Impact Analysis

This vulnerability can lead to memory leaks, causing system instability or crashes over time due to exhausted resources. It may also result in unauthorized access to host-side resources if the leaked resource IDs are exploited. Systems using VirtIO GPU for virtualization could experience performance degradation or unexpected behavior.

Mitigation Strategies

Update your Linux kernel to the latest stable version where this vulnerability is patched. If immediate patching is not possible, disable the VirtIO GPU driver if not required. Monitor system logs for GPU-related errors and restrict access to GPU resources in virtualized environments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98609. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart