{"id":"CVE-2026-98607","kind":"vulnerability","aliases":["CVE-2026-98607"],"related":[],"title":"Linux kernel: virtio-gpu blob ioctl leaks objects on error paths","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()\n\nvirtio_gpu_resource_create_blob_ioctl() calls drm_gem_object_release() on\nboth the virtio_gpu_resource_assign_uuid() and drm_gem_handle_create()\nerror paths instead of dropping the reference it owns, so\nobj->funcs->free() never runs and the virtio_gpu_object, the resource id\nand the host-side resource are leaked.\n\nUse drm_gem_object_put() instead.","summary":"In the Linux kernel's virtio-gpu DRM driver, error paths in the blob resource creation ioctl release GEM objects incorrectly, so the object, its resource id and the host-side resource are never freed. The effect described is a resource leak that can accumulate over time, and the sources do not describe code execution or data exposure.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drm","infrastructure","kernel","linux","virtio-gpu"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:13+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:27+00:00","updated_at":"2026-10-25T05:21:27+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:21:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: virtio-gpu blob ioctl leaks objects on error paths","impact":"low","summary":"In the Linux kernel's virtio-gpu DRM driver, error paths in the blob resource creation ioctl release GEM objects incorrectly, so the object, its resource id and the host-side resource are never freed. The effect described is a resource leak that can accumulate over time, and the sources do not describe code execution or data exposure.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","virtio-gpu","drm"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; leaks kernel and host-side resources on failed calls","analyst_note":"Check the kernel stable commit referenced by NVD for affected version ranges and fixed kernel versions, and confirm whether virtio-gpu blob ioctl is reachable by unprivileged local users.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000547,"input_tokens":3411,"output_tokens":411,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98607':15A,18A 'accumul':72B 'assign':124C 'blob':6A,40B,105C,111C 'call':113C 'code':81B 'creat':104C,110C,130C 'creation':42B 'cve':13A,16A 'data':84B 'describ':65B,80B 'driver':35B 'drm':19B,34B,114C,127C,163C 'drm/virtio':96C 'drop':135C 'effect':64B 'error':11A,36B,131C 'execut':82B 'exposur':85B 'fix':97C 'follow':91C 'free':143C 'freed':62B 'func':142C 'gem':45B,115C,128C,164C 'gpu':5A,25B,33B,102C,108C,122C,149C 'handl':129C 'host':57B,157C 'host-sid':56B,156C 'id':53B,153C 'incorrect':47B 'infrastructur':20B 'instead':133C,167C 'ioctl':7A,43B,106C,112C 'kernel':2A,21B,29B,89C 'leak':8A,69B,99C,161C 'linux':1A,22B,28B,88C 'never':61B,144C 'obj':141C 'object':9A,46B,50B,98C,116C,150C,165C 'own':139C 'path':12A,37B,132C 'put':166C 'refer':137C 'releas':44B,117C 'resolv':95C 'resourc':41B,52B,59B,68B,103C,109C,123C,152C,159C 'run':145C 'side':58B,158C 'sourc':77B 'time':74B 'use':162C 'uuid':125C 'virtio':4A,24B,32B,101C,107C,121C,148C 'virtio-gpu':3A,23B,31B 'vulner':92C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98607","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98607","severity":null,"published_at":"2026-10-18T16:17:13+00:00","modified_at":"2026-10-19T10:19:22+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}