CVE-2026-98609: drm/virtio: fix object leak when drm_gem_handle_create() fails

CVE-2026-98609: drm/virtio: fix object leak when drm_gem_handle_create() fails

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: fix object leak when drm_gem_handle_create() fails

virtio_gpu_gem_create() owns the reference taken by
virtio_gpu_object_create(). On the drm_gem_handle_create() error path it
calls drm_gem_object_release() instead of dropping that reference.

drm_gem_object_release() is the inverse of drm_gem_object_init() and does
not touch the reference count or call obj->funcs->free(), so it is only
correct as the last step of a destructor, as in
virtio_gpu_cleanup_object(). Using it here leaves the bo at refcount 1
with no remaining reference, so virtio_gpu_free_object() never runs and
the shmem pages, sg table and virtio_gpu_object are leaked. Since
virtio_gpu_object_create() has already set bo->created,
VIRTIO_GPU_CMD_RESOURCE_UNREF is not queued either, leaking the host-side
resource and the resource id.

drm_gem_handle_create_tail() drops the handle reference on all of its
internal error paths, so the caller only has to drop its own. Use
drm_gem_object_put(), matching the success path below.

The Linux kernel CVE team has assigned CVE-2026-98609 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.2 with commit dc5698e80cf724770283e10414054662bdf6ccfa and fixed in 5.10.271 with commit 13423a058187c2039aa8cb235c916be4477221b7
	Issue introduced in 4.2 with commit dc5698e80cf724770283e10414054662bdf6ccfa and fixed in 5.15.222 with commit 687be2f8b5e0e0ca9a7028f8f6413d0ed3fbb9dc
	Issue introduced in 4.2 with commit dc5698e80cf724770283e10414054662bdf6ccfa and fixed in 6.1.189 with commit 264ae8ac8fd625b6c118baf16c111adeee2ec632
	Issue introduced in 4.2 with commit dc5698e80cf724770283e10414054662bdf6ccfa and fixed in 6.6.158 with commit e2edd2d78d2cf8446de017adec9598feefed3297
	Issue introduced in 4.2 with commit dc5698e80cf724770283e10414054662bdf6ccfa and fixed in 6.12.112 with commit 372e9c3d45f664a2c000427ccbf6cdc2f99b3170
	Issue introduced in 4.2 with commit dc5698e80cf724770283e10414054662bdf6ccfa and fixed in 6.18.55 with commit a93dce15dfef200c346b050a2acbed516cc62706
	Issue introduced in 4.2 with commit dc5698e80cf724770283e10414054662bdf6ccfa and fixed in 7.2.9 with commit f75066c79d1eec453c0d386ef8636873d1e11f2c
	Issue introduced in 4.2 with commit dc5698e80cf724770283e10414054662bdf6ccfa and fixed in 7.3-rc5 with commit 36570ef2244cc4d7563b1f0157bc0f032498638c

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-98609
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/virtio/virtgpu_gem.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/13423a058187c2039aa8cb235c916be4477221b7
	https://git.kernel.org/stable/c/687be2f8b5e0e0ca9a7028f8f6413d0ed3fbb9dc
	https://git.kernel.org/stable/c/264ae8ac8fd625b6c118baf16c111adeee2ec632
	https://git.kernel.org/stable/c/e2edd2d78d2cf8446de017adec9598feefed3297
	https://git.kernel.org/stable/c/372e9c3d45f664a2c000427ccbf6cdc2f99b3170
	https://git.kernel.org/stable/c/a93dce15dfef200c346b050a2acbed516cc62706
	https://git.kernel.org/stable/c/f75066c79d1eec453c0d386ef8636873d1e11f2c
	https://git.kernel.org/stable/c/36570ef2244cc4d7563b1f0157bc0f032498638c