From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5C1F02EACF2 for ; Sun, 18 Oct 2026 15:33:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792337603; cv=none; b=feW3uCN9oz8vOWjxZ2epM6trvSHjIzj9EXJR/1OJqstAJ6a9k84K1uCNKtpyyBWiSKDBiuutxyd8/tK4SzyECvw/M30Y9Y1BFa16GX3/ntTly2DQiTSV59PbIREt89W1vQjG+KdVpC4+xzfnaI1KP0oydzSOGUX+Ok1y2bH5zrs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792337603; c=relaxed/simple; bh=oiiA5fIVsd9nFdNAbl7QEBmDqnmKMYJmQyp1UreV7Uw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=eQFjbb+Flkp4Sn8TgOJKPgZKFjYbVCc30Jg5BQjee8NZzR24xdIEE/RG5q3m/UvLO2M/TJEJm2tKoOYv6uxEZDeBtREpkJzEsaifzUgkkU2DRLC2ukjDL3vhFY2VmXfdTxDDKLGpLAKXDaaSLevsgODhrtOZYVY8PrE1lK730VU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=y/Fz/9I3; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="y/Fz/9I3" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 688871F000C4; Sun, 18 Oct 2026 15:33:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792337602; bh=6bsbzorg66qx75PtWCP4JlK1SqC86mEMqJbrXMbHpNc=; h=From:To:Cc:Subject:Date:Reply-To; b=y/Fz/9I38cigUKzam2Ps9A1PGJEST1FDEqWRxMbBqpm2FG+1Ape3x+C+ZdBlQt7cw SqYjAhECVYg+bGsRoxGangKQkgPF2Z0nqIlA5HE4E7D7AmxUp9x66a/kelBcoHdZSp xKmTF1BwmbCnac4rOzyiUigvqAbGttw7HKNgYqB8= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-98609: drm/virtio: fix object leak when drm_gem_handle_create() fails Date: Sun, 18 Oct 2026 17:17:53 +0200 Message-ID: <2026101839-CVE-2026-98609-5cc7@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4116; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=ftP8nT3PWVOmmMFJw2tcTmBb5VwWWdhtP/7jxFapubw=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlXHs02tGB5ccNM70Fv45X+vRHGG/X0np0784b7ntdNu Q3/1lm2d8SyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBEcuMYFuw9kudgdbZHqry2 amnRkdLtJ/IyfjDMFZTtfHimnWXmX58bR12fz/qo9kjkOQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak when drm_gem_handle_create() fails virtio_gpu_gem_create() owns the reference taken by virtio_gpu_object_create(). On the drm_gem_handle_create() error path it calls drm_gem_object_release() instead of dropping that reference. drm_gem_object_release() is the inverse of drm_gem_object_init() and does not touch the reference count or call obj->funcs->free(), so it is only correct as the last step of a destructor, as in virtio_gpu_cleanup_object(). Using it here leaves the bo at refcount 1 with no remaining reference, so virtio_gpu_free_object() never runs and the shmem pages, sg table and virtio_gpu_object are leaked. Since virtio_gpu_object_create() has already set bo->created, VIRTIO_GPU_CMD_RESOURCE_UNREF is not queued either, leaking the host-side resource and the resource id. drm_gem_handle_create_tail() drops the handle reference on all of its internal error paths, so the caller only has to drop its own. Use drm_gem_object_put(), matching the success path below. The Linux kernel CVE team has assigned CVE-2026-98609 to this issue. Affected and fixed versions =========================== Issue introduced in 4.2 with commit dc5698e80cf724770283e10414054662bdf6ccfa and fixed in 5.10.271 with commit 13423a058187c2039aa8cb235c916be4477221b7 Issue introduced in 4.2 with commit dc5698e80cf724770283e10414054662bdf6ccfa and fixed in 5.15.222 with commit 687be2f8b5e0e0ca9a7028f8f6413d0ed3fbb9dc Issue introduced in 4.2 with commit dc5698e80cf724770283e10414054662bdf6ccfa and fixed in 6.1.189 with commit 264ae8ac8fd625b6c118baf16c111adeee2ec632 Issue introduced in 4.2 with commit dc5698e80cf724770283e10414054662bdf6ccfa and fixed in 6.6.158 with commit e2edd2d78d2cf8446de017adec9598feefed3297 Issue introduced in 4.2 with commit dc5698e80cf724770283e10414054662bdf6ccfa and fixed in 6.12.112 with commit 372e9c3d45f664a2c000427ccbf6cdc2f99b3170 Issue introduced in 4.2 with commit dc5698e80cf724770283e10414054662bdf6ccfa and fixed in 6.18.55 with commit a93dce15dfef200c346b050a2acbed516cc62706 Issue introduced in 4.2 with commit dc5698e80cf724770283e10414054662bdf6ccfa and fixed in 7.2.9 with commit f75066c79d1eec453c0d386ef8636873d1e11f2c Issue introduced in 4.2 with commit dc5698e80cf724770283e10414054662bdf6ccfa and fixed in 7.3-rc5 with commit 36570ef2244cc4d7563b1f0157bc0f032498638c Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-98609 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/gpu/drm/virtio/virtgpu_gem.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/13423a058187c2039aa8cb235c916be4477221b7 https://git.kernel.org/stable/c/687be2f8b5e0e0ca9a7028f8f6413d0ed3fbb9dc https://git.kernel.org/stable/c/264ae8ac8fd625b6c118baf16c111adeee2ec632 https://git.kernel.org/stable/c/e2edd2d78d2cf8446de017adec9598feefed3297 https://git.kernel.org/stable/c/372e9c3d45f664a2c000427ccbf6cdc2f99b3170 https://git.kernel.org/stable/c/a93dce15dfef200c346b050a2acbed516cc62706 https://git.kernel.org/stable/c/f75066c79d1eec453c0d386ef8636873d1e11f2c https://git.kernel.org/stable/c/36570ef2244cc4d7563b1f0157bc0f032498638c