Memory leak in Linux kernel - CVE-2026-98609

Vulnerability identifier: #VU156915

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98609

CWE-ID: CWE-401

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to leak guest memory and host-side graphics resources, potentially causing a denial of service through resource exhaustion.

The vulnerability exists due to improper reference-count management in virtio_gpu_gem_create() when graphics handle creation fails. A local user can trigger object creation operations that encounter drm_gem_handle_create() failures to leave graphics objects allocated without a remaining reference, leaking guest memory and host-side resources and potentially causing a denial of service.

Linux kernel
Ubuntu
linux-nvidia-tegra (Ubuntu package)
linux-nvidia-tegra-igx (Ubuntu package)
linux-nvidia-tegra-5.15 (Ubuntu package)
linux (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-aws (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-nvidia-tegra (Ubuntu package) - update to 5.15.0-1070.72
linux-nvidia-tegra-igx (Ubuntu package) - update to 5.15.0-1059.59
linux-nvidia-tegra-5.15 (Ubuntu package) - update to 5.15.0-1070.72~20.04.1
linux (Ubuntu package) - update to 7.0.0-42.42
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/13423a058187c2039aa8cb235c916be4477221b7
• https://git.kernel.org/stable/c/264ae8ac8fd625b6c118baf16c111adeee2ec632
• https://git.kernel.org/stable/c/36570ef2244cc4d7563b1f0157bc0f032498638c
• https://git.kernel.org/stable/c/372e9c3d45f664a2c000427ccbf6cdc2f99b3170
• https://git.kernel.org/stable/c/687be2f8b5e0e0ca9a7028f8f6413d0ed3fbb9dc
• https://git.kernel.org/stable/c/a93dce15dfef200c346b050a2acbed516cc62706
• https://git.kernel.org/stable/c/e2edd2d78d2cf8446de017adec9598feefed3297
• https://git.kernel.org/stable/c/f75066c79d1eec453c0d386ef8636873d1e11f2c

• Memory leak in Linux kernel drm virtio driver
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more
• Ubuntu update for linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-nvidia-tegra-igx
• Ubuntu update for linux, linux-aws, linux-aws-5.15 and more