CVE-2026-98607: drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()
In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: fix object leaks in virtiogpuresourcecreateblobioctl()
virtiogpuresourcecreateblobioctl() calls drmgemobjectrelease() on both the virtiogpuresourceassignuuid() and drmgemhandlecreate() error paths instead of dropping the reference it owns, so obj->funcs->free() never runs and the virtiogpuobject, the resource id and the host-side resource are leaked.
Use drmgemobjectput() instead.
Affected Software
Event History
Frequently Asked Questions
When does the resource leak occur?
The leak occurs when virtio_gpu_resource_create_blob_ioctl() reaches an error path after virtio_gpu_resource_assign_uuid() or drm_gem_handle_create() fails. On those paths, the object reference is not properly dropped, so the object cleanup callback does not run.
What resources can remain allocated?
The affected error handling can leak the virtio_gpu_object, its resource ID, and the corresponding host-side resource.