SB2026102284 - Memory leak in Linux kernel drm virtio driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102284

SB2026102284 - Memory leak in Linux kernel drm virtio driver

Published: October 22, 2026

Security Bulletin ID SB2026102284
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Partial DoS

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Memory leak (CVE-ID: CVE-2026-98509)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local user to leak kernel memory and potentially cause a denial of service through memory exhaustion.

The vulnerability exists due to a memory leak in the Linux kernel virtio GPU driver's execbuffer error handling when a submission fails after reserving a DRM event for a ring with userspace polling enabled. A local user can repeatedly submit execbuffer requests with invalid buffer handles or input sync objects without fences to leave event allocations permanently orphaned and potentially exhaust kernel memory.


Remediation

Install update from vendor's website.

References