SB20261022186 - Use-after-free in Linux kernel drm virtio driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261022186

SB20261022186 - Use-after-free in Linux kernel drm virtio driver

Published: October 22, 2026

Security Bulletin ID SB20261022186
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Use-after-free (CVE-ID: CVE-2026-98606)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to trigger invalid kernel memory accesses and potentially cause a denial of service.

The vulnerability exists due to use-after-free in virtio_gpu_vram_create() in the Linux kernel virtio GPU driver when handling object creation failures. A local user can trigger an error path that frees a GEM object without removing its registered VMA offset node, causing subsequent offset lookups or insertions to access freed memory and potentially crash the system.


Remediation

Install update from vendor's website.

References