Live › vulnerability › CVE-2026-98607
Go to dashboardIn the Linux kernel's virtio-gpu DRM driver, error paths in the blob resource creation ioctl release GEM objects incorrectly, so the object, its resource id and the host-side resource are never freed. The effect described is a resource leak that can accumulate over time, and the sources do not describe code execution or data exposure.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()
virtio_gpu_resource_create_blob_ioctl() calls drm_gem_object_release() on both the virtio_gpu_resource_assign_uuid() and drm_gem_handle_create() error paths instead of dropping the reference it owns, so obj->funcs->free() never runs and the virtio_gpu_object, the resource id and the host-side resource are leaked.
Use drm_gem_object_put() instead.
This page as .md · .json · in your agent: get_signal("CVE-2026-98607")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.