CVE-2026-98509

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: fix memory leak of fence event on execbuffer failure

virtio_gpu_execbuffer_ioctl() reserves a DRM event with

drm_event_reserve_init() when VIRTGPU_EXECBUF_RING_IDX selects a ring that

userspace has enabled polling for. virtio_gpu_init_submit() does this

before the BO handles, the command buffer, the syncobj arrays and the

in-fence are processed, so every later error path runs with the event

already pending, including plain argument validation failures such as an

invalid bo_handle or an in-syncobj that carries no fence.

On those paths, virtio_gpu_cleanup_submit() drops the out-fence without

cancelling the event. The fence is freed without ever having been emitted,

taking the only driver-side pointer to the event with it. Closing the DRM

file does not help. drm_events_release() unlinks pending events but

deliberately leaves the freeing to the driver's later drm_send_event(),

which never runs for an orphane

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References