CVE-2026-98608: drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
Published Oct 18, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: fix object leak in virtiogpuresourcecreateioctl()
virtiogpuresourcecreateioctl() calls drmgemobjectrelease() on the drmgemhandlecreate() error path instead of dropping the reference it owns, so obj->funcs->free() never runs and the virtiogpuobject, its pages and sg table, the resource id and the host-side resource are leaked.
Use drmgemobjectput() instead.
Affected Software
1 affected component
Linux Linux kernel
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In drm/virtio, change virtio_gpu_resource_create_ioctl() to use drm_gem_object_put() instead of drm_gem_object_release() on the drm_gem_handle_create() error path, so the object reference is properly dropped.
Event History
Oct 18, 2026
CVE Published
via MITRE·03:19 PM
Data Sourced
via MITRE·03:19 PM
Description
Data Sourced
via NVD·04:17 PM
Description