CVE-2026-64098

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: use uninterruptible resv lock for plane updates

virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() lock

the framebuffer BO's dma_resv via virtio_gpu_array_lock_resv() and

ignore its return value. The function can fail with -EINTR from

dma_resv_lock_interruptible() (signal during lock wait) or with

-ENOMEM from dma_resv_reserve_fences() (fence slot allocation),

leaving the resv lock not held. The queue path then walks the object

array and calls dma_resv_add_fence(), which requires the lock held;

with lockdep enabled this trips dma_resv_assert_held():

WARNING: drivers/dma-buf/dma-resv.c:296 at dma_resv_add_fence+0x71e/0x840

Call Trace:

virtio_gpu_array_add_fence

virtio_gpu_queue_ctrl_sgs

virtio_gpu_queue_fenced_ctrl_buffer

virtio_gpu_cursor_plane_update

drm_atomic_helper_commit_planes

drm_atomic_helper_commit_tail

commit_tail

drm_atomic_helper_commit

drm_atomic_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References