{"id":"CVE-2026-98609","kind":"vulnerability","aliases":["CVE-2026-98609"],"related":[],"title":"Linux kernel virtio-gpu: object leak when GEM handle creation fails","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: fix object leak when drm_gem_handle_create() fails\n\nvirtio_gpu_gem_create() owns the reference taken by\nvirtio_gpu_object_create(). On the drm_gem_handle_create() error path it\ncalls drm_gem_object_release() instead of dropping that reference.\n\ndrm_gem_object_release() is the inverse of drm_gem_object_init() and does\nnot touch the reference count or call obj->funcs->free(), so it is only\ncorrect as the last step of a destructor, as in\nvirtio_gpu_cleanup_object(). Using it here leaves the bo at refcount 1\nwith no remaining reference, so virtio_gpu_free_object() never runs and\nthe shmem pages, sg table and virtio_gpu_object are leaked. Since\nvirtio_gpu_object_create() has already set bo->created,\nVIRTIO_GPU_CMD_RESOURCE_UNREF is not queued either, leaking the host-side\nresource and the resource id.\n\ndrm_gem_handle_create_tail() drops the handle reference on all of its\ninternal error paths, so the caller only has to drop its own. Use\ndrm_gem_object_put(), matching the success path below.","summary":"When creating a virtio-gpu buffer object fails at the handle step, the kernel drops the wrong reference, so the shared memory pages, scatter-gather table and host-side resource are never freed. The sources describe a resource leak and do not describe an attacker gaining access or running code.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","other","virtio-gpu","virtual-machines"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:13+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:25+00:00","updated_at":"2026-10-25T05:21:25+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T05:21:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel virtio-gpu: object leak when GEM handle creation fails","impact":"low","summary":"When creating a virtio-gpu buffer object fails at the handle step, the kernel drops the wrong reference, so the shared memory pages, scatter-gather table and host-side resource are never freed. The sources describe a resource leak and do not describe an attacker gaining access or running code.","category":"other","nicknames":[],"who_cares":["linux-kernel","virtio-gpu","virtual-machines"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel memory and host resources leak; no code execution described","analyst_note":"Check the kernel.org stable commit for the fixed versions and whether a local user can trigger the failure path repeatedly.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running a Linux kernel with the virtio-gpu DRM driver, such as virtual machines using virtio GPU devices. The sources do not say which kernel versions are fixed, so the affected range is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000577,"input_tokens":3623,"output_tokens":429,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98609':15A,18A '1':184C 'access':78B 'alreadi':214C 'attack':76B 'bo':181C,216C 'buffer':35B 'call':124C,154C 'caller':255C 'cleanup':174C 'cmd':220C 'code':81B 'correct':162C 'count':152C 'creat':30B,100C,105C,114C,120C,212C,217C,240C 'creation':11A 'cve':13A,16A 'describ':67B,74B 'destructor':169C 'drm':97C,117C,125C,134C,142C,237C,263C 'drm/virtio':92C 'drop':44B,131C,242C,259C 'either':226C 'error':121C,251C 'fail':12A,37B,101C 'fix':93C 'follow':87C 'free':157C,192C 'freed':64B 'func':156C 'gain':77B 'gather':55B 'gem':9A,98C,104C,118C,126C,135C,143C,238C,264C 'gpu':5A,25B,34B,103C,112C,173C,191C,204C,210C,219C 'handl':10A,40B,99C,119C,239C,244C 'host':59B,230C 'host-sid':58B,229C 'id':236C 'init':145C 'instead':129C 'intern':250C 'invers':140C 'kernel':2A,21B,43B,85C 'last':165C 'leak':7A,70B,95C,207C,227C 'leav':179C 'linux':1A,20B,84C 'linux-kernel':19B 'machin':28B 'match':267C 'memori':51B 'never':63B,194C 'obj':155C 'object':6A,36B,94C,113C,127C,136C,144C,175C,193C,205C,211C,265C 'own':106C 'page':52B,199C 'path':122C,252C,270C 'put':266C 'queu':225C 'refcount':183C 'refer':47B,108C,133C,151C,188C,245C 'releas':128C,137C 'remain':187C 'resolv':91C 'resourc':61B,69B,221C,232C,235C 'run':80B,195C 'scatter':54B 'scatter-gath':53B 'set':215C 'sg':200C 'share':50B 'shmem':198C 'side':60B,231C 'sinc':208C 'sourc':66B 'step':41B,166C 'success':269C 'tabl':56B,201C 'tail':241C 'taken':109C 'touch':149C 'unref':222C 'use':176C,262C 'virtio':4A,24B,33B,102C,111C,172C,190C,203C,209C,218C 'virtio-gpu':3A,23B,32B 'virtual':27B 'virtual-machin':26B 'vulner':88C 'wrong':46B","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the virtio-gpu DRM driver, such as virtual machines using virtio GPU devices. The sources do not say which kernel versions are fixed, so the affected range is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98609","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98609","severity":null,"published_at":"2026-10-18T16:17:13+00:00","modified_at":"2026-10-19T10:19:22+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}