CVE-2026-98509
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:
drm/virtio: corregir fuga de memoria del evento de fence en caso de fallo de execbuffer
virtio_gpu_execbuffer_ioctl() reserva un evento DRM con drm_event_reserve_init() cuando VIRTGPU_EXECBUF_RING_IDX selecciona un ring para el que el espacio de usuario ha habilitado el sondeo. virtio_gpu_init_submit() hace esto antes de procesar los handles de BO, el búfer de comandos, los arrays de syncobj y el in-fence, de modo que todas las rutas de error posteriores se ejecutan con el evento ya pendiente, incluidas las validaciones simples de argumentos como un bo_handle no válido o un in-syncobj que no contiene ningún fence.
Leer descripción completaMostrar menos
En esas rutas, virtio_gpu_cleanup_submit() libera el out-fence sin cancelar el evento. El fence se libera sin haber sido emitido nunca, llevándose consigo el único puntero del lado del controlador hacia el evento. Cerrar el archivo DRM no ayuda: drm_events_release() desvincula los eventos pendientes, pero deja deliberadamente su liberación en manos de la posterior drm_send_event() del controlador, que nunca se ejecuta para un evento huérfano, de modo que la asignación queda filtrada de forma permanente.
Detectado al hacer fuzzing del controlador virtio con Syzkaller:
BUG: memory leak unreferenced object 0xffff88802c176e80 (size 96): comm "syz.1.367", pid 10561, jiffies 4294960122 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ c8 6e 17 2c 80 88 ff ff 00 00 00 00 00 00 00 00 .n.,............ backtrace (crc e1973c6b): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4597 [inline] slab_alloc_node mm/slub.c:4917 [inline] __kmalloc_cache_noprof+0x49d/0x6f0 mm/slub.c:5485 _kmalloc_noprof include/linux/slab.h:988 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] virtio_gpu_fence_event_create drivers/gpu/drm/virtio/virtgpu_submit.c:282 [inline] virtio_gpu_init_submit drivers/gpu/drm/virtio/virtgpu_submit.c:398 [inline] virtio_gpu_execbuffer_ioctl+0xbbf/0x1aa0 drivers/gpu/drm/virtio/virtgpu_submit.c:505 drm_ioctl_kernel+0x1f4/0x3e0 drivers/gpu/drm/drm_ioctl.c:817 drm_ioctl+0x5f4/0xc70 drivers/gpu/drm/drm_ioctl.c:914 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Se corrige cancelando y liberando el evento DRM en la ruta de error de execbuffer antes de liberar el fence. Se limpia el puntero de evento del fence tras la cancelación para que no conserve un puntero colgante.
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.20 %
- Percentil entre todas las CVEs puntuadas
- 9
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 5 referencias
- https://git.kernel.org/stable/c/43bfe2b60c149bf6effda25f245a00509061fa15
- https://git.kernel.org/stable/c/4e333e2336138f4659b1d7a0371c499f80428612
- https://git.kernel.org/stable/c/8fa78900fd24247277c03dc7b8a2864cb12d4340
- https://git.kernel.org/stable/c/ae583668f16d41fcc1b54f45848c1b6ac1d6669a
- https://git.kernel.org/stable/c/b74aad23d99b279bb34d135795f39a6d8ecdc075
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98509",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "cd7f5ca33585918febe5e2f6dc090a21cfa775b0",
"lessThan": "43bfe2b60c149bf6effda25f245a00509061fa15",
"versionType": "git"
},
{
"status": "affected",
"version": "cd7f5ca33585918febe5e2f6dc090a21cfa775b0",
"lessThan": "4e333e2336138f4659b1d7a0371c499f80428612",
"versionType": "git"
},
{
"status": "affected",
"version": "cd7f5ca33585918febe5e2f6dc090a21cfa775b0",
"lessThan": "8fa78900fd24247277c03dc7b8a2864cb12d4340",
"versionType": "git"
},
{
"status": "affected",
"version": "cd7f5ca33585918febe5e2f6dc090a21cfa775b0",
"lessThan": "ae583668f16d41fcc1b54f45848c1b6ac1d6669a",
"versionType": "git"
},
{
"status": "affected",
"version": "cd7f5ca33585918febe5e2f6dc090a21cfa775b0",
"lessThan": "b74aad23d99b279bb34d135795f39a6d8ecdc075",
"versionType": "git"
}
],
"programFiles": [
"drivers/gpu/drm/virtio/virtgpu_submit.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.16",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/gpu/drm/virtio/virtgpu_submit.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:02.083",
"references": [
{
"url": "https://git.kernel.org/stable/c/43bfe2b60c149bf6effda25f245a00509061fa15",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4e333e2336138f4659b1d7a0371c499f80428612",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8fa78900fd24247277c03dc7b8a2864cb12d4340",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ae583668f16d41fcc1b54f45848c1b6ac1d6669a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b74aad23d99b279bb34d135795f39a6d8ecdc075",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: fix memory leak of fence event on execbuffer failure\n\nvirtio_gpu_execbuffer_ioctl() reserves a DRM event with\ndrm_event_reserve_init() when VIRTGPU_EXECBUF_RING_IDX selects a ring that\nuserspace has enabled polling for. virtio_gpu_init_submit() does this\nbefore the BO handles, the command buffer, the syncobj arrays and the\nin-fence are processed, so every later error path runs with the event\nalready pending, including plain argument validation failures such as an\ninvalid bo_handle or an in-syncobj that carries no fence.\n\nOn those paths, virtio_gpu_cleanup_submit() drops the out-fence without\ncancelling the event. The fence is freed without ever having been emitted,\ntaking the only driver-side pointer to the event with it. Closing the DRM\nfile does not help. drm_events_release() unlinks pending events but\ndeliberately leaves the freeing to the driver's later drm_send_event(),\nwhich never runs for an orphaned event, so the allocation is leaked\npermanently.\n\nFound when fuzzing the virtio driver with Syzkaller:\n\n\tBUG: memory leak\n\tunreferenced object 0xffff88802c176e80 (size 96):\n\tcomm \"syz.1.367\", pid 10561, jiffies 4294960122\n\thex dump (first 32 bytes):\n\t\t00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n\t\tc8 6e 17 2c 80 88 ff ff 00 00 00 00 00 00 00 00 .n.,............\n\tbacktrace (crc e1973c6b):\n\t\tkmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]\n\t\tslab_post_alloc_hook mm/slub.c:4597 [inline]\n\t\tslab_alloc_node mm/slub.c:4917 [inline]\n\t\t__kmalloc_cache_noprof+0x49d/0x6f0 mm/slub.c:5485\n\t\t_kmalloc_noprof include/linux/slab.h:988 [inline]\n\t\t_kzalloc_noprof include/linux/slab.h:1309 [inline]\n\t\tvirtio_gpu_fence_event_create drivers/gpu/drm/virtio/virtgpu_submit.c:282 [inline]\n\t\tvirtio_gpu_init_submit drivers/gpu/drm/virtio/virtgpu_submit.c:398 [inline]\n\t\tvirtio_gpu_execbuffer_ioctl+0xbbf/0x1aa0 drivers/gpu/drm/virtio/virtgpu_submit.c:505\n\t\tdrm_ioctl_kernel+0x1f4/0x3e0 drivers/gpu/drm/drm_ioctl.c:817\n\t\tdrm_ioctl+0x5f4/0xc70 drivers/gpu/drm/drm_ioctl.c:914\n\t\tvfs_ioctl fs/ioctl.c:51 [inline]\n\t\t__do_sys_ioctl fs/ioctl.c:597 [inline]\n\t\t__se_sys_ioctl fs/ioctl.c:583 [inline]\n\t\t__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583\n\t\tdo_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n\t\tdo_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94\n\t\tentry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFix by cancelling and freeing the DRM event on the execbuffer error path\nbefore dropping the fence. Clear the fence's event pointer after\ncancellation so it does not retain a dangling pointer."
}
],
"lastModified": "2026-10-19T10:19:04.340",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}