CVE-2026-98608

What it actually does

virtio_gpu_resource_create_ioctl calls drm_gem_object_release on the drm_gem_handle_create error path instead of drm_gem_object_put, preventing obj->funcs->free from running and leaking the virtio_gpu_object along with its pages, sg_table, resource ID and host-side resource.

Why it matters to the business

Repeated use of the affected IOCTL can exhaust kernel memory over time, leading to degraded graphics or GPU virtualization performance and eventual denial of service on systems that rely on virtio GPU.

How an attack unfolds

An attacker with access to a virtio GPU device repeatedly invokes the resource creation IOCTL in a way that triggers the error path, causing incremental leaks of kernel objects until memory pressure forces system instability or crashes.

How to fix it

Update the Linux kernel to a version containing the commit that replaces drm_gem_object_release with drm_gem_object_put in virtio_gpu_resource_create_ioctl.

How to confirm the fix worked

Confirm the presence of the corrected drm_gem_object_put call in the virtio_gpu_resource_create_ioctl function and verify that no downstream dependents still ship the older release call on the error path.

Typical attack path

1. Obtain access to a guest or process that can open a virtio GPU device
2. Issue repeated virtio_gpu_resource_create_ioctl calls engineered to hit the drm_gem_handle_create failure path
3. Observe gradual kernel memory consumption without corresponding object release
4. Continue until memory exhaustion produces denial of service or forces a reboot

How to detect it

Review kernel memory accounting logs and virtio GPU driver traces for repeated object allocations without matching frees; look for increasing counts of unreleased GEM objects in /proc or debugfs after IOCTL activity.

What your security team should do

• Prioritize kernel upgrades on any hosts using virtio GPU (high volume of dependents increases exposure)
• Monitor memory usage trends on virtio GPU enabled systems for unexplained growth
• Apply the fix within normal patch windows given low EPSS and absence from KEV