CVE-2026-98606

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: release the GEM object on virtio_gpu_vram_create() errors

virtio_gpu_vram_create() frees the object with a bare kfree(vram) on

both error paths after drm_gem_private_object_init() has run, and on the

second one after drm_gem_create_mmap_offset() has linked obj->vma_node

into the device's VMA offset manager. The freed object stays in that

interval tree, so a later lookup or insertion walks freed memory, and

the dma_resv and gpuva lock are never destroyed.

Call drm_gem_object_release() before kfree() on both paths.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References