CVE-2026-98607

What it actually does

The vulnerability causes memory and resource leaks in the virtio GPU driver when error paths are taken during blob resource creation, preventing proper cleanup of GEM objects and associated host resources.

Why it matters to the business

Repeated triggering can lead to gradual kernel memory exhaustion, potentially causing system instability or denial of service in virtualized environments using virtio GPU.

How an attack unfolds

An attacker with access to the virtio GPU ioctl interface triggers specific error conditions in resource creation, causing the kernel to leak objects instead of freeing them. Over time or with multiple attempts, this depletes resources.

How to fix it

Apply the kernel patch that replaces drm_gem_object_release() with drm_gem_object_put() in the error paths of virtio_gpu_resource_create_blob_ioctl(). Reboot affected systems after update.

How to confirm the fix worked

Verify the presence of the fix in the kernel source or check for updated kernel packages. Monitor for absence of leak reports in affected code paths.

Typical attack path

1. Identify a process or context with access to DRM virtio GPU ioctls
2. Craft calls to virtio_gpu_resource_create_blob_ioctl that hit error paths after partial allocation
3. Repeat to accumulate leaks

How to detect it

Look for kernel memory leak warnings or increasing memory usage without corresponding processes in systems using virtio GPU drivers. Audit logs for repeated DRM ioctl failures.

What your security team should do

• Prioritize kernel updates for systems using virtio GPU
• Monitor memory usage in virtualized environments
• Limit access to GPU device nodes where possible