Live › vulnerability › CVE-2026-98608
Go to dashboardA failed handle creation in the virtio GPU resource ioctl releases the object incorrectly, so its memory, pages and host-side resource are never freed. The sources describe a resource leak, not code execution or data exposure.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the virtio-gpu DRM driver, such as virtual machines using virtio GPU acceleration. The sources do not say which kernel versions are affected or whether a fixed release exists.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
virtio_gpu_resource_create_ioctl() calls drm_gem_object_release() on the drm_gem_handle_create() error path instead of dropping the reference it owns, so obj->funcs->free() never runs and the virtio_gpu_object, its pages and sg table, the resource id and the host-side resource are leaked.
Use drm_gem_object_put() instead.
This page as .md · .json · in your agent: get_signal("CVE-2026-98608")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.