All vulnerabilities
CVE-2026-98609

Linux: drm/virtio: fix object leak when drm_gem_handle_create() fails

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in13423a058187c2039aa8cb235c916be4477221b7Also 687be2f8b5e0e0ca9a7028f8f6413d0ed3fbb9dc, 264ae8ac8fd625b6c118baf16c111adeee2ec632 and 2 moreCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 13423a058187c2039aa8cb235c916be4477221b7LinuxCVE List
  • 687be2f8b5e0e0ca9a7028f8f6413d0ed3fbb9dcLinuxCVE List
  • 264ae8ac8fd625b6c118baf16c111adeee2ec632LinuxCVE List
  • 372e9c3d45f664a2c000427ccbf6cdc2f99b3170LinuxCVE List
  • 36570ef2244cc4d7563b1f0157bc0f032498638cLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: fix object leak when drm_gem_handle_create() fails

virtio_gpu_gem_create() owns the reference taken by virtio_gpu_object_create(). On the drm_gem_handle_create() error path it calls drm_gem_object_release() instead of dropping that reference.

drm_gem_object_release() is the inverse of drm_gem_object_init() and does not touch the reference count or call obj->funcs->free(), so it is only correct as the last step of a destructor, as in virtio_gpu_cleanup_object(). Using it here leaves the bo at refcount 1 with no remaining reference, so virtio_gpu_free_object() never runs and the shmem pages, sg table and virtio_gpu_object are leaked. Since virtio_gpu_object_create() has already set bo->created, VIRTIO_GPU_CMD_RESOURCE_UNREF is not queued either, leaking the host-side resource and the resource id.

drm_gem_handle_create_tail() drops the handle reference on all of its internal error paths, so the caller only has to drop its own. Use drm_gem_object_put(), matching the success path below.

Text from CVE List

Affected versions 18

  • Linuxaffected: dc5698e80cf724770283e10414054662bdf6ccfa before 13423a058187c2039aa8cb235c916be4477221b7CVE List
  • Linuxaffected: dc5698e80cf724770283e10414054662bdf6ccfa before 687be2f8b5e0e0ca9a7028f8f6413d0ed3fbb9dcCVE List
  • Linuxaffected: dc5698e80cf724770283e10414054662bdf6ccfa before 264ae8ac8fd625b6c118baf16c111adeee2ec632CVE List
  • Linuxaffected: dc5698e80cf724770283e10414054662bdf6ccfa before e2edd2d78d2cf8446de017adec9598feefed3297CVE List
  • Linuxaffected: dc5698e80cf724770283e10414054662bdf6ccfa before 372e9c3d45f664a2c000427ccbf6cdc2f99b3170CVE List
  • Linuxaffected: dc5698e80cf724770283e10414054662bdf6ccfa before a93dce15dfef200c346b050a2acbed516cc62706CVE List
  • Linuxaffected: dc5698e80cf724770283e10414054662bdf6ccfa before f75066c79d1eec453c0d386ef8636873d1e11f2cCVE List
  • Linuxaffected: dc5698e80cf724770283e10414054662bdf6ccfa before 36570ef2244cc4d7563b1f0157bc0f032498638cCVE List
  • Linuxaffected: 4.2CVE List
  • Linuxunaffected: all versions before 4.2CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8