CVE-2023-22998

What it actually does

The flaw arises from misinterpreting the return value of drm_gem_shmem_get_sg_table in drivers/gpu/drm/virtio/virtgpu_object.c: the function returns an error pointer on failure, yet the caller treats only NULL as an error, allowing subsequent dereference of an invalid pointer and resulting in kernel memory corruption or panic.

Why it matters to the business

Virtualized Linux systems using the virtio GPU driver may suffer sudden kernel crashes and service interruptions, increasing operational downtime; the low EPSS and absence from KEV indicate limited real-world exploitation risk despite the 1326-day exposure window.

How an attack unfolds

A local attacker on an affected system triggers graphics operations that exercise the virtio GPU object code path; when drm_gem_shmem_get_sg_table fails, the error pointer is used as a valid table, leading to invalid memory access that an attacker may attempt to turn into denial of service.

How to fix it

Upgrade the Linux kernel to version 6.0.3 or newer; apply commit c24968734abfed81c8f93dc5f44a7b7a9aecadfa to correct the error-pointer handling in virtgpu_object.c.

How to confirm the fix worked

Confirm the running kernel is at least 6.0.3; inspect drivers/gpu/drm/virtio/virtgpu_object.c to verify the corrected error check replaces the NULL test with IS_ERR or equivalent.

Typical attack path

1. Obtain local user privileges on a Linux system running an affected kernel with virtio GPU enabled
2. Perform graphics or display operations that invoke virtgpu_object.c
3. Force drm_gem_shmem_get_sg_table to return an error pointer
4. Trigger subsequent invalid pointer dereference to crash the kernel

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages referencing virtio, drm_gem_shmem_get_sg_table, or virtgpu_object.c around the time of crashes.

What your security team should do

• Apply the kernel update to all systems exposing virtio GPU
• Reboot after patching and monitor for virtio-related kernel panics
• Restrict local access on unpatched systems until remediation completes