CVE-2026-98606: drm/virtio: release the GEM object on virtio_gpu_vram_create() errors
In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: release the GEM object on virtiogpuvramcreate() errors
virtiogpuvramcreate() frees the object with a bare kfree(vram) on both error paths after drmgemprivateobjectinit() has run, and on the second one after drmgemcreatemmapoffset() has linked obj->vmanode into the device's VMA offset manager. The freed object stays in that interval tree, so a later lookup or insertion walks freed memory, and the dmaresv and gpuva lock are never destroyed.
Call drmgemobjectrelease() before kfree() on both paths.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In virtio_gpu_vram_create(), call drm_gem_object_release() before kfree(vram) on both error paths: after drm_gem_private_object_init() and after drm_gem_create_mmap_offset() has linked obj->vma_node.