CVE-2026-98608: Linux Kernel DRM Virtio Memory Leak Vulnerability

CVE-2026-98608 Overview

CVE-2026-98608 is a memory leak vulnerability in the Linux kernel's drm/virtio driver. The flaw resides in the virtio_gpu_resource_create_ioctl() function, which handles resource creation requests for virtio-based GPU devices used in virtualized environments.

When drm_gem_handle_create() fails, the function incorrectly calls drm_gem_object_release() instead of dropping the reference it owns. As a result, obj->funcs->free() never executes. This leaves the virtio_gpu_object, its backing pages, the scatter-gather (sg) table, the resource id, and the host-side resource allocated but unreachable.

Critical Impact
Repeated invocation of the affected ioctl on the error path causes guest and host memory exhaustion, degrading virtualization host stability over time.

Affected Products

Linux kernel versions containing the vulnerable virtio_gpu_resource_create_ioctl() implementation in drivers/gpu/drm/virtio
Guest operating systems running on virtio-GPU-enabled hypervisors (QEMU/KVM)
Distributions shipping affected stable kernel branches prior to the backported fix

Discovery Timeline

2026-10-18 - CVE-2026-98608 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98608

Vulnerability Analysis

The virtio_gpu_resource_create_ioctl() function allocates a virtio_gpu_object and then attempts to register it with userspace through drm_gem_handle_create(). On success, the handle takes its own reference and the function must drop the local reference it holds.

The vulnerable code path handled the error case from drm_gem_handle_create() incorrectly. It invoked drm_gem_object_release(), which only tears down a subset of GEM state. The reference count was never decremented through the proper put path, so the object's free() callback never ran.

Because free() never executes, the Direct Rendering Manager (DRM) object, its allocated pages, the scatter-gather table describing them, the virtio resource identifier, and the corresponding host-side resource all remain allocated. Each failed ioctl invocation accumulates leaked state in both the guest kernel and the hypervisor process.

Root Cause

The root cause is incorrect reference counting [memory leak] on an error path. drm_gem_object_release() is a teardown helper intended for use during object destruction, not for dropping a caller-held reference. The correct function is drm_gem_object_put(), which decrements the refcount and triggers the free() callback when the count reaches zero.

Attack Vector

An unprivileged local user inside a guest with access to the virtio-GPU DRM device can trigger the leak by repeatedly invoking the resource-creation ioctl under conditions that cause drm_gem_handle_create() to fail. The vulnerability manifests on the error path in drivers/gpu/drm/virtio; see the kernel git commits referenced below for the exact patch diff.

No code execution primitive is documented. The impact is confined to resource exhaustion against the guest kernel and the host virtio-GPU backend.

Detection Methods for CVE-2026-98608

Indicators of Compromise

Sustained growth in kernel slab allocations attributable to virtio_gpu_object and associated sg_table structures
Rising host-side resource counts in the QEMU/virtio-gpu backend without corresponding guest workload growth
Repeated userspace invocations of DRM_IOCTL_VIRTGPU_RESOURCE_CREATE returning errors

Detection Strategies

Monitor /proc/slabinfo for abnormal growth in DRM and virtio-gpu related caches on guest systems
Correlate guest ioctl failure rates with host-side memory consumption of the virtualization process
Audit userspace processes invoking virtio-gpu ioctls, especially from unprivileged contexts

Monitoring Recommendations

Track long-term memory baselines for virtualization hosts and alert on unexplained upward drift
Enable kernel memory leak detection (kmemleak) in test environments running affected kernels
Review DRM subsystem logs for repeated virtio_gpu_resource_create_ioctl error returns

How to Mitigate CVE-2026-98608

Immediate Actions Required

Apply the upstream kernel fix that replaces drm_gem_object_release() with drm_gem_object_put() in virtio_gpu_resource_create_ioctl()
Update to a distribution kernel that includes the backported patch from the stable trees
Restart guest virtual machines after kernel updates to ensure the fixed driver is loaded

Patch Information

The fix replaces the incorrect release call with drm_gem_object_put(), ensuring the reference the function owns is dropped properly and obj->funcs->free() runs. The patch has been merged across multiple stable branches. Reference commits: 1586ee6, 477bc30, 574ae9f, 749d8bb, 77dee8e, 83c8991, b516446, and d33d5ef.

Workarounds

Restrict access to /dev/dri/* nodes in guests so only trusted users can invoke virtio-gpu ioctls
Disable the virtio-gpu device in guest configurations where graphical acceleration is not required
Enforce per-VM resource quotas on the hypervisor to contain the blast radius of resource exhaustion

bash

# Verify running kernel includes the fix after update
uname -r
modinfo virtio-gpu | grep -E 'filename|version'