CVE-2026-98608

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-98608
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98608.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-98608
Downstream
Published
2026-10-18T15:19:23Z
Modified
2026-10-20T02:30:46Z
Summary
drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
Details

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()

virtio_gpu_resource_create_ioctl() calls drm_gem_object_release() on the drm_gem_handle_create() error path instead of dropping the reference it owns, so obj->funcs->free() never runs and the virtio_gpu_object, its pages and sg table, the resource id and the host-side resource are leaked.

Use drm_gem_object_put() instead.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98608.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
62fb7a5e10962ac6ae2a2d2dbd3aedcb2a3e3257
Fixed
d33d5ef8225538f76e4598c09e2074834667bb8d
Fixed
1586ee6107acab3b14510ac6af939f1253269df8
Fixed
83c899104496677068fbbd2e42f28fd625f9cd85
Fixed
77dee8e9106d62bf4f51b646c801f51f8ee77339
Fixed
574ae9fa5fd3658bee23cb544fe5a0d1d750016a
Fixed
b516446a25bf365cfffe3d7884ea6637f7f70862
Fixed
749d8bb964b3414ef967d5ec80f2f1b5b3a510d9
Fixed
477bc3068fc3777b9d8ffd79e265b0dfdf2d3a6b

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98608.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.4.0
Fixed
5.10.271
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.222
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.189
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.158
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.112
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.55
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98608.json"