CVE-2026-98509: drm/virtio: fix memory leak of fence event on execbuffer failure
drm/virtio: fix memory leak of fence event on execbuffer failure
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.159.1-1 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.159.1-1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.158 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.55 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.9 - Compensating control
In the virtio GPU execbuffer error path, cancel and free the DRM event before dropping the fence, then clear the fence's event pointer after cancellation so it does not retain a dangling pointer.
Event History
Frequently Asked Questions
Who is exposed to this leak?
Systems using the Linux virtio GPU driver are exposed when userspace submits an execbuffer request selecting a ring for which it has enabled polling. The leak is triggered only if processing later fails after the DRM event has been reserved.
What input conditions can trigger the issue?
An attacker or local userspace client needs to issue the relevant execbuffer ioctl with a polling-enabled ring and cause a subsequent error. Examples given include an invalid buffer-object handle or an input sync object that has no fence.
Does closing the DRM file reclaim the leaked memory?
No. Closing the DRM file unlinks pending events, but the event allocation is only freed when the driver later sends the event; that never occurs for this orphaned event.
How can this issue be detected?
The issue manifests as permanently leaked fence-event allocations on failed execbuffer submissions. It was identified through Syzkaller fuzzing and reported as an unreferenced 96-byte memory leak.