From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DF08F3A7F60 for ; Sun, 19 Jul 2026 15:43:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784475825; cv=none; b=icxqUxH8AIS6hopeZpTht7/eychPtI9IWPVauyDWxw2m6qFfkO41Uz5uh4REbY31XwJH8vkzj35RmovXPbDuZBZHQtHsC68NN7ov2XUj+WWtqXitF6bVqQTQ8vSaLifzv4Z9NvIvuzvAYEVGmOlNigy4E0WlC3ihBmdgb2HmOL8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784475825; c=relaxed/simple; bh=fB3ZMyaw81jDP8ZVsPqnQ1qq3lFiQOEzvaaTWmoWSeU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=kC/08/w714SWcKr21B/H4AmSHz/5KnSkPySp2SoMsEk0CmNh6xyGwI9CPTuzejzjcaMTPv8MHfhuaXAObwdhX90WjaJ2MmOhmRUsimctwmTaCipEVXLX+E9Qo7kNj1OYc5KOtj96bWGfOX631tXSEPuuTpz/IjDA6/UVMNllv6g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=rxdCQ+sr; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="rxdCQ+sr" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DDADF1F000E9; Sun, 19 Jul 2026 15:43:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784475823; bh=YvifUQdJWvZv1TseKFi9UFDsIsrJKkMY2NTuKU36l68=; h=From:To:Cc:Subject:Date:Reply-To; b=rxdCQ+srgId4kkE/hMOPcWC5t729SPDOlo2rYYIxJbddegxGsHJjGOKmxnWJbotta RpfjtqPkBGRvrIBTC2Ki0QSwqTYWpHGnGaT3fgy4yQyXJ5aVeWa7fgxVQI2K0w+TzK 1SHZOiT0k9EKEtRzfAVBsXX/RQQhC99k22GZPUxc= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates Date: Sun, 19 Jul 2026 17:39:20 +0200 Message-ID: <2026071919-CVE-2026-64098-b8ed@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=5400; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=tPzcCZwfRLxWqGoBd2Pxmzy9prD6D69PZVkJh22ecsE=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkx77NTs06kVr53Yzv+rn/r+zvsS3YFbX8cyrHzepX4p 9vxZz4964hlYRBkYpAVU2T5so3n6P6KQ4pehranYeawMoEMYeDiFICJ/LvDsGBSTfyvH7Iap3kP XrjJGh387aJz5kKG+f7hRXEyiS2ZbvczZBJaq3e7vlc3AAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use uninterruptible resv lock for plane updates virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() lock the framebuffer BO's dma_resv via virtio_gpu_array_lock_resv() and ignore its return value. The function can fail with -EINTR from dma_resv_lock_interruptible() (signal during lock wait) or with -ENOMEM from dma_resv_reserve_fences() (fence slot allocation), leaving the resv lock not held. The queue path then walks the object array and calls dma_resv_add_fence(), which requires the lock held; with lockdep enabled this trips dma_resv_assert_held(): WARNING: drivers/dma-buf/dma-resv.c:296 at dma_resv_add_fence+0x71e/0x840 Call Trace: virtio_gpu_array_add_fence virtio_gpu_queue_ctrl_sgs virtio_gpu_queue_fenced_ctrl_buffer virtio_gpu_cursor_plane_update drm_atomic_helper_commit_planes drm_atomic_helper_commit_tail commit_tail drm_atomic_helper_commit drm_atomic_commit drm_atomic_helper_update_plane __setplane_atomic drm_mode_cursor_universal drm_mode_cursor_common drm_mode_cursor_ioctl drm_ioctl __x64_sys_ioctl Beyond the WARN, mutating the dma_resv fence list without the lock races with concurrent readers/writers and can corrupt the list. Both call sites run inside the .atomic_update plane callback, which DRM atomic helpers do not allow to fail (by the time it runs, the commit has been signed off to userspace and there is no clean rollback path). Moving the lock acquisition to .prepare_fb was rejected because the broader lock scope deadlocks against other BO locking paths in the same atomic commit. Introduce virtio_gpu_lock_one_resv_uninterruptible() that uses dma_resv_lock() instead of dma_resv_lock_interruptible(). This eliminates the -EINTR failure mode -- the realistic syzbot trigger -- without extending the lock hold across the commit. The helper locks a single BO and rejects nents > 1 with -EINVAL; both fix sites lock exactly one BO. Use it from virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush(); check the return value to handle the remaining -ENOMEM case from dma_resv_reserve_fences() by freeing the objs and skipping the plane update for that frame. The framebuffer BOs touched here are not shared with other contexts and lock contention is expected to be brief, so the loss of signal-interruptibility is acceptable. Other callers of virtio_gpu_array_lock_resv() (the ioctl paths) continue to use the interruptible variant. The bug was reported by syzbot, triggered via fault injection (fail_nth) on the DRM_IOCTL_MODE_CURSOR path, which forces the -ENOMEM branch in dma_resv_reserve_fences(). The Linux kernel CVE team has assigned CVE-2026-64098 to this issue. Affected and fixed versions =========================== Issue introduced in 5.7 with commit 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 and fixed in 6.1.175 with commit c86077d512ee980cc91322211d35dbcd3175f64c Issue introduced in 5.7 with commit 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 and fixed in 6.6.142 with commit 21ab64c77a30d56efc506c8fa2ad8959f8ce3d36 Issue introduced in 5.7 with commit 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 and fixed in 6.12.92 with commit 7930eee22cd3df61e85be8aa512032ab303b7167 Issue introduced in 5.7 with commit 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 and fixed in 6.18.34 with commit 8fadd01cf461fee5bb11506621339c548447e5c7 Issue introduced in 5.7 with commit 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 and fixed in 7.0.11 with commit a2359a411b15f495d12cfda6a7db6855ebb7f90f Issue introduced in 5.7 with commit 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 and fixed in 7.1 with commit 9af1b6e175c82daf4b423da339a722d8e67a735a Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-64098 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/gpu/drm/virtio/virtgpu_drv.h drivers/gpu/drm/virtio/virtgpu_gem.c drivers/gpu/drm/virtio/virtgpu_plane.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/c86077d512ee980cc91322211d35dbcd3175f64c https://git.kernel.org/stable/c/21ab64c77a30d56efc506c8fa2ad8959f8ce3d36 https://git.kernel.org/stable/c/7930eee22cd3df61e85be8aa512032ab303b7167 https://git.kernel.org/stable/c/8fadd01cf461fee5bb11506621339c548447e5c7 https://git.kernel.org/stable/c/a2359a411b15f495d12cfda6a7db6855ebb7f90f https://git.kernel.org/stable/c/9af1b6e175c82daf4b423da339a722d8e67a735a