{"id":"CVE-2026-98606","kind":"vulnerability","aliases":["CVE-2026-98606"],"related":[],"title":"Linux kernel: virtio-gpu error path frees GPU object still in use","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: release the GEM object on virtio_gpu_vram_create() errors\n\nvirtio_gpu_vram_create() frees the object with a bare kfree(vram) on\nboth error paths after drm_gem_private_object_init() has run, and on the\nsecond one after drm_gem_create_mmap_offset() has linked obj->vma_node\ninto the device's VMA offset manager. The freed object stays in that\ninterval tree, so a later lookup or insertion walks freed memory, and\nthe dma_resv and gpuva lock are never destroyed.\n\nCall drm_gem_object_release() before kfree() on both paths.","summary":"When creating a virtio GPU VRAM object fails, the Linux kernel frees the object while it is still linked into the device's offset manager, so later lookups walk freed memory. The sources do not state what an attacker can do with this beyond a use-after-free in the kernel.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","linux","virtio-gpu","virtualization"],"not_affected_if":["no-virtio-gpu"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-18T16:17:13+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:28+00:00","updated_at":"2026-10-25T05:21:28+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:21:28Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel: virtio-gpu error path frees GPU object still in use","impact":"medium","summary":"When creating a virtio GPU VRAM object fails, the Linux kernel frees the object while it is still linked into the device's offset manager, so later lookups walk freed memory. The sources do not state what an attacker can do with this beyond a use-after-free in the kernel.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","virtualization","virtio-gpu"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; kernel memory use-after-free, impact not stated","analyst_note":"Check the upstream kernel commit and NVD entry for affected and fixed versions and the exploitability of the use-after-free from a guest.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-virtio-gpu"],"who_is_affected":"Systems running a Linux kernel with the virtio-gpu DRM driver, typically virtual machines using virtio-gpu for graphics. The sources do not say which kernel versions are fixed or affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000566,"input_tokens":3433,"output_tokens":445,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98606':16A,19A 'attack':65B 'bare':109C 'beyond':70B 'call':174C 'creat':28B,98C,103C,132C 'cve':14A,17A 'destroy':173C 'devic':48B,142C 'dma':166C 'drm':117C,130C,175C 'drm/virtio':89C 'error':6A,99C,114C 'fail':34B 'follow':84C 'free':8A,38B,75B,104C 'freed':56B,148C,162C 'gem':92C,118C,131C,176C 'gpu':5A,9A,25B,31B,96C,101C 'gpuva':169C 'infrastructur':20B 'init':121C 'insert':160C 'interv':153C 'kernel':2A,21B,37B,78B,82C 'kfree':110C,180C 'later':53B,157C 'link':45B,136C 'linux':1A,22B,36B,81C 'lock':170C 'lookup':54B,158C 'manag':51B,146C 'memori':57B,163C 'mmap':133C 'never':172C 'node':139C 'obj':137C 'object':10A,33B,40B,93C,106C,120C,149C,177C 'offset':50B,134C,145C 'one':128C 'path':7A,115C,183C 'privat':119C 'releas':90C,178C 'resolv':88C 'resv':167C 'run':123C 'second':127C 'sourc':59B 'state':62B 'stay':150C 'still':11A,44B 'tree':154C 'use':13A,73B 'use-after-fre':72B 'virtio':4A,24B,30B,95C,100C 'virtio-gpu':3A,23B 'virtual':26B 'vma':138C,144C 'vram':32B,97C,102C,111C 'vulner':85C 'walk':55B,161C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the virtio-gpu DRM driver, typically virtual machines using virtio-gpu for graphics. The sources do not say which kernel versions are fixed or affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98606","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98606","severity":null,"published_at":"2026-10-18T16:17:13+00:00","modified_at":"2026-10-19T10:19:22+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}