CVE-2026-98607

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-98607
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98607.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-98607
Downstream
Published
2026-10-18T15:19:21Z
Modified
2026-10-19T02:46:52Z
Summary
drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()
Details

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()

virtio_gpu_resource_create_blob_ioctl() calls drm_gem_object_release() on both the virtio_gpu_resource_assign_uuid() and drm_gem_handle_create() error paths instead of dropping the reference it owns, so obj->funcs->free() never runs and the virtio_gpu_object, the resource id and the host-side resource are leaked.

Use drm_gem_object_put() instead.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98607.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
897b4d1acaf56314652c6a8e75d9f86b5e45638d
Fixed
73ea38a89b923fa08047885a0845d1cd89261ead
Fixed
eea473532a286cd1b13cddbec5c645989f43a3aa
Fixed
88c60c06a2a5244f5dd32ec098e633add114890f
Fixed
0455867bbd95ffa9d9db0a1c6dda500f8126232c
Fixed
81c6769e069d703154087377d1749af2f1b74e49
Fixed
02df4e24dc4c0bf5b0425a6acabc5201d7f04fc2
Fixed
24b6d5c7641412c9ebef0d4c8b888d49a0e6b880

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98607.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.222
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.189
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.158
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.112
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.55
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98607.json"