All vulnerabilities
CVE-2026-98607

Linux: drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in73ea38a89b923fa08047885a0845d1cd89261eadAlso 88c60c06a2a5244f5dd32ec098e633add114890f, 0455867bbd95ffa9d9db0a1c6dda500f8126232c and 3 moreCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 73ea38a89b923fa08047885a0845d1cd89261eadLinuxCVE List
  • 88c60c06a2a5244f5dd32ec098e633add114890fLinuxCVE List
  • 0455867bbd95ffa9d9db0a1c6dda500f8126232cLinuxCVE List
  • 81c6769e069d703154087377d1749af2f1b74e49LinuxCVE List
  • 02df4e24dc4c0bf5b0425a6acabc5201d7f04fc2LinuxCVE List
  • 24b6d5c7641412c9ebef0d4c8b888d49a0e6b880LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()

virtio_gpu_resource_create_blob_ioctl() calls drm_gem_object_release() on both the virtio_gpu_resource_assign_uuid() and drm_gem_handle_create() error paths instead of dropping the reference it owns, so obj->funcs->free() never runs and the virtio_gpu_object, the resource id and the host-side resource are leaked.

Use drm_gem_object_put() instead.

Text from CVE List

Affected versions 16

  • Linuxaffected: 897b4d1acaf56314652c6a8e75d9f86b5e45638d before 73ea38a89b923fa08047885a0845d1cd89261eadCVE List
  • Linuxaffected: 897b4d1acaf56314652c6a8e75d9f86b5e45638d before eea473532a286cd1b13cddbec5c645989f43a3aaCVE List
  • Linuxaffected: 897b4d1acaf56314652c6a8e75d9f86b5e45638d before 88c60c06a2a5244f5dd32ec098e633add114890fCVE List
  • Linuxaffected: 897b4d1acaf56314652c6a8e75d9f86b5e45638d before 0455867bbd95ffa9d9db0a1c6dda500f8126232cCVE List
  • Linuxaffected: 897b4d1acaf56314652c6a8e75d9f86b5e45638d before 81c6769e069d703154087377d1749af2f1b74e49CVE List
  • Linuxaffected: 897b4d1acaf56314652c6a8e75d9f86b5e45638d before 02df4e24dc4c0bf5b0425a6acabc5201d7f04fc2CVE List
  • Linuxaffected: 897b4d1acaf56314652c6a8e75d9f86b5e45638d before 24b6d5c7641412c9ebef0d4c8b888d49a0e6b880CVE List
  • Linuxaffected: 5.11CVE List
  • Linuxunaffected: all versions before 5.11CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 7