{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98607", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.359Z", "datePublished": "2026-10-18T15:19:21.585Z", "dateUpdated": "2026-10-19T09:22:34.330Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:22:34.330Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()\n\nvirtio_gpu_resource_create_blob_ioctl() calls drm_gem_object_release() on\nboth the virtio_gpu_resource_assign_uuid() and drm_gem_handle_create()\nerror paths instead of dropping the reference it owns, so\nobj->funcs->free() never runs and the virtio_gpu_object, the resource id\nand the host-side resource are leaked.\n\nUse drm_gem_object_put() instead."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/virtio/virtgpu_ioctl.c"], "versions": [{"version": "897b4d1acaf56314652c6a8e75d9f86b5e45638d", "lessThan": "73ea38a89b923fa08047885a0845d1cd89261ead", "status": "affected", "versionType": "git"}, {"version": "897b4d1acaf56314652c6a8e75d9f86b5e45638d", "lessThan": "eea473532a286cd1b13cddbec5c645989f43a3aa", "status": "affected", "versionType": "git"}, {"version": "897b4d1acaf56314652c6a8e75d9f86b5e45638d", "lessThan": "88c60c06a2a5244f5dd32ec098e633add114890f", "status": "affected", "versionType": "git"}, {"version": "897b4d1acaf56314652c6a8e75d9f86b5e45638d", "lessThan": "0455867bbd95ffa9d9db0a1c6dda500f8126232c", "status": "affected", "versionType": "git"}, {"version": "897b4d1acaf56314652c6a8e75d9f86b5e45638d", "lessThan": "81c6769e069d703154087377d1749af2f1b74e49", "status": "affected", "versionType": "git"}, {"version": "897b4d1acaf56314652c6a8e75d9f86b5e45638d", "lessThan": "02df4e24dc4c0bf5b0425a6acabc5201d7f04fc2", "status": "affected", "versionType": "git"}, {"version": "897b4d1acaf56314652c6a8e75d9f86b5e45638d", "lessThan": "24b6d5c7641412c9ebef0d4c8b888d49a0e6b880", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/virtio/virtgpu_ioctl.c"], "versions": [{"version": "5.11", "status": "affected"}, {"version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/73ea38a89b923fa08047885a0845d1cd89261ead"}, {"url": "https://git.kernel.org/stable/c/eea473532a286cd1b13cddbec5c645989f43a3aa"}, {"url": "https://git.kernel.org/stable/c/88c60c06a2a5244f5dd32ec098e633add114890f"}, {"url": "https://git.kernel.org/stable/c/0455867bbd95ffa9d9db0a1c6dda500f8126232c"}, {"url": "https://git.kernel.org/stable/c/81c6769e069d703154087377d1749af2f1b74e49"}, {"url": "https://git.kernel.org/stable/c/02df4e24dc4c0bf5b0425a6acabc5201d7f04fc2"}, {"url": "https://git.kernel.org/stable/c/24b6d5c7641412c9ebef0d4c8b888d49a0e6b880"}], "title": "drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/virtio/virtgpu_ioctl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "73ea38a89b923fa08047885a0845d1cd89261ead", "status": "affected", "version": "897b4d1acaf56314652c6a8e75d9f86b5e45638d", "versionType": "git"}, {"lessThan": "eea473532a286cd1b13cddbec5c645989f43a3aa", "status": "affected", "version": "897b4d1acaf56314652c6a8e75d9f86b5e45638d", "versionType": "git"}, {"lessThan": "88c60c06a2a5244f5dd32ec098e633add114890f", "status": "affected", "version": "897b4d1acaf56314652c6a8e75d9f86b5e45638d", "versionType": "git"}, {"lessThan": "0455867bbd95ffa9d9db0a1c6dda500f8126232c", "status": "affected", "version": "897b4d1acaf56314652c6a8e75d9f86b5e45638d", "versionType": "git"}, {"lessThan": "81c6769e069d703154087377d1749af2f1b74e49", "status": "affected", "version": "897b4d1acaf56314652c6a8e75d9f86b5e45638d", "versionType": "git"}, {"lessThan": "02df4e24dc4c0bf5b0425a6acabc5201d7f04fc2", "status": "affected", "version": "897b4d1acaf56314652c6a8e75d9f86b5e45638d", "versionType": "git"}, {"lessThan": "24b6d5c7641412c9ebef0d4c8b888d49a0e6b880", "status": "affected", "version": "897b4d1acaf56314652c6a8e75d9f86b5e45638d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/virtio/virtgpu_ioctl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"lessThan": "5.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()\n\nvirtio_gpu_resource_create_blob_ioctl() calls drm_gem_object_release() on\nboth the virtio_gpu_resource_assign_uuid() and drm_gem_handle_create()\nerror paths instead of dropping the reference it owns, so\nobj->funcs->free() never runs and the virtio_gpu_object, the resource id\nand the host-side resource are leaked.\n\nUse drm_gem_object_put() instead."}], "id": "CVE-2026-98607", "lastModified": "2026-10-19T10:19:22.620", "metrics": {}, "published": "2026-10-18T16:17:13.450", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/02df4e24dc4c0bf5b0425a6acabc5201d7f04fc2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0455867bbd95ffa9d9db0a1c6dda500f8126232c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/24b6d5c7641412c9ebef0d4c8b888d49a0e6b880"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/73ea38a89b923fa08047885a0845d1cd89261ead"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/81c6769e069d703154087377d1749af2f1b74e49"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/88c60c06a2a5244f5dd32ec098e633add114890f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eea473532a286cd1b13cddbec5c645989f43a3aa"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()", "id": "2554941", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554941"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()\nvirtio_gpu_resource_create_blob_ioctl() calls drm_gem_object_release() on\nboth the virtio_gpu_resource_assign_uuid() and drm_gem_handle_create()\nerror paths instead of dropping the reference it owns, so\nobj->funcs->free() never runs and the virtio_gpu_object, the resource id\nand the host-side resource are leaked.\nUse drm_gem_object_put() instead.", "A flaw was found in the Linux kernel's VirtIO GPU driver. This vulnerability allows a local user to cause a denial of service (DoS) through memory and resource exhaustion. When errors occur during the creation of graphical resources, the driver fails to properly release object references, preventing allocated kernel objects and host-side resources from being freed. An attacker can repeatedly trigger these error conditions to leak system memory over time, degrading performance or rendering the system unresponsive."], "name": "CVE-2026-98607", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98607\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98607\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98607.mbox"], "threat_severity": "Low"}