{"schema":"threatline.record/2","record":{"id":"CVE-2026-98156","aliases":[],"summary":"drm/virtio: use the DMA API for resource backing on Xen","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: use the DMA API for resource backing on Xen\n\nOn a Xen PV domain page addresses bear no relation to the real machine\naddresses the host would have to use to reach it.\nvirtio_ring.c handles this correctly, vring_use_map_api() returns true\nfor any xen_domain() regardless of VIRTIO_F_ACCESS_PLATFORM.\n\nvirtio-gpu makes the same decision independently, but its copy\nlooks only at the feature bit:\n\n\tbool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev);\n\nQEMU does not set iommu_platform on virtio-vga by default, so\nVIRTIO_F_ACCESS_PLATFORM is not negotiated, use_dma_api is false, and\nvirtio_gpu_object_shmem_init() describes the framebuffer's backing pages\nto the host with sg_phys().  Those are guest-physical addresses. In a PV\ndomain they resolve, on the host side, to pages belonging to some other\ndomain, so the host scans out unrelated memory.\n\nMove the decision into virtio_gpu_use_dma_api() and give it the\nxen_domain() check, like vring_use_map_api() has. This\nadditionally enables the dma_sync_sgtable_for_device() calls in\nvirtgpu_vq.c, which are required for correctness whenever swiotlb\nis in play.\n\nReproduced with a Xen 4.21 PV dom0 nested inside QEMU 8.2 with\nvirtio-vga, on both a distro 6.8 kernel and 6.18 LTS. A PVH dom0\nworks fine and doesn't need this fix because it is identity-mapped,\nonly PV dom0s are affected.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98156","source_modified_at":"2026-10-21T12:54:43.922Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"a3b815f09bb846255c458c181b8a5b1cc66891b4","lessThan":"32e999ccf5f6453b3b4df8264ff1b03c6720292f","status":"affected","versionType":"git"},{"version":"a3b815f09bb846255c458c181b8a5b1cc66891b4","lessThan":"3f130cc6826fabf50e01fe8e4ff3ed1fcae50d36","status":"affected","versionType":"git"},{"version":"a3b815f09bb846255c458c181b8a5b1cc66891b4","lessThan":"93c557e947ef0040004b1ac6a1c1265d79a957e1","status":"affected","versionType":"git"},{"version":"a3b815f09bb846255c458c181b8a5b1cc66891b4","lessThan":"455184dbe9652d01470d3c5cf5edd09a7a673a99","status":"affected","versionType":"git"},{"version":"a3b815f09bb846255c458c181b8a5b1cc66891b4","lessThan":"6a736d2f9d0c6e6217fe7532bc4c50ceca71db78","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98156","source_modified_at":"2026-10-21T12:54:43.922Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"4.20","status":"affected"},{"version":"0","lessThan":"4.20","status":"unaffected","versionType":"semver"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98156","source_modified_at":"2026-10-21T12:54:43.922Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"32e999ccf5f6453b3b4df8264ff1b03c6720292f","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98156","source_modified_at":"2026-10-21T12:54:43.922Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"3f130cc6826fabf50e01fe8e4ff3ed1fcae50d36","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98156","source_modified_at":"2026-10-21T12:54:43.922Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"93c557e947ef0040004b1ac6a1c1265d79a957e1","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98156","source_modified_at":"2026-10-21T12:54:43.922Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"455184dbe9652d01470d3c5cf5edd09a7a673a99","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98156","source_modified_at":"2026-10-21T12:54:43.922Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"6a736d2f9d0c6e6217fe7532bc4c50ceca71db78","basis":"first unaffected version stated in the CVE record"}],"cvss":7.8,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00135,"percentile":0.02702,"score_date":"2026-10-23"},"published_at":"2026-09-25T10:36:26.409Z","modified_at":"2026-10-21T12:54:43.922Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-98156","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-21T12:54:43.922Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98156","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/32e999ccf5f6453b3b4df8264ff1b03c6720292f"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/3f130cc6826fabf50e01fe8e4ff3ed1fcae50d36"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/93c557e947ef0040004b1ac6a1c1265d79a957e1"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/455184dbe9652d01470d3c5cf5edd09a7a673a99"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/6a736d2f9d0c6e6217fe7532bc4c50ceca71db78"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-21T12:54:43.922Z","content_hash":"dfdeda347378d96d3e4ad2a90db1574f149a4b70d86a7ac80a2fc7fedb2c8554"}}