CVE-2026-98404: drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: Fix a NULL vs ERRPTR() bug in virtiogpuuserframebuffercreate()
Smatch complains that returning a NULL here will lead to a NULL pointer dereference in drmmodeaddfb2(). Return an error pointer instead.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In drm/virtio, update virtio_gpu_user_framebuffer_create() to return an ERR_PTR() error pointer instead of NULL when creation fails, preventing a NULL-pointer dereference in drm_mode_addfb2().
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue is in the Linux kernel's drm/virtio code and affects the virtio GPU user framebuffer creation path. The provided data does not identify specific kernel versions or configurations.
What is the observed failure mode?
A NULL return from virtio_gpu_user_framebuffer_create() can result in a NULL pointer dereference in drm_mode_addfb2(). The fix changes that return to an error pointer.