CLEANSTART-2026-CA04971 Memory leak in the virgl_cmd_resource_unref function in hw/display/virtio-gpu-3d

Security vulnerability affects the qemu package. Memory leak in the virglcmdresourceunref function in hw/display/virtio-gpu-3d...

CLEANSTART-2026-VJ95514 Memory leak in the virtio_gpu_resource_attach_backing function in hw/display/virtio-gpu

Security vulnerability affects the qemu package. Memory leak in the virtiogpuresourceattachbacking function in hw/display/virtio-gpu...

CLEANSTART-2026-LK74952 Memory leak in the virgl_resource_attach_backing function in hw/display/virtio-gpu-3d

Security vulnerability affects the qemu package. Memory leak in the virglresourceattachbacking function in hw/display/virtio-gpu-3d...

CLEANSTART-2026-DU71688 Memory leak in the virtio_gpu_resource_create_2d function in hw/display/virtio-gpu

Security vulnerability affects the qemu package. Memory leak in the virtiogpuresourcecreate2d function in hw/display/virtio-gpu...

CVE-2026-98608

A flaw was found in the Linux kernel's VirtIO GPU graphics processing unit driver. When handling resource creation requests, an improper error-handling path fails to release acquired object references upon failure, causing memory and system resources to leak. A local user could exploit this flaw ...

CVE-2026-98609

A flaw was found in the Linux kernel's VirtIO GPU driver. When graphics buffer handle creation fails, the driver improperly handles object references, preventing cleanup functions from freeing allocated memory and host resources. A local attacker could exploit this vulnerability to trigger a...

CVE-2026-98607

A flaw was found in the Linux kernel's VirtIO GPU driver. This vulnerability allows a local user to cause a denial of service DoS through memory and resource exhaustion. When errors occur during the creation of graphical resources, the driver fails to properly release object references, preventin...

CVE-2026-98606

A flaw was found in the Linux kernel's VirtIO GPU driver. During error handling when creating video memory resources, the driver deallocates memory without properly releasing the object from kernel memory tracking structures. A local user can exploit this vulnerability to trigger a use-after-free...

CVE-2026-98509

A flaw was found in the Linux kernel's virtio graphics processing unit virtio-gpu driver. A local user can cause a Denial of Service DoS by triggering a kernel memory leak during graphics command buffer processing. When invalid submission parameters are provided, the driver's error-handling path...

CVE-2026-98508

A flaw was found in the Linux kernel's VirtIO GPU driver. This flaw allows a local user to cause a denial of service DoS by triggering a kernel crash. Under memory pressure, the driver fails to verify whether fence memory allocation succeeds during graphics command submission, leading to an...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix driver removal with disabled KMS DRM atomic and modesetting are not initialized when the virtio-gpu driver is built with disabled KMS, resulting in access to uninitialized data during driver removal/unbinding and...

PT-2026-116827

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An object leak exists in the virtio gpu resource create ioctl function. The issue occurs when the function calls drm gem object release during the drm gem handle create error path instea...

PT-2026-128617

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak when drm gem handle create fails virtio gpu gem create owns the reference taken by virtio gpu object create. On the drm gem handle create error path it calls drm gem object release instead of dropping...

PT-2026-128546

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference on fence allocation failure virtio gpu fence alloc can fail due to memory pressure and return NULL, but its caller like virtio gpu init submit never checks it. Later, virtio gpu init submi...

PT-2026-128510

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak in virtio gpu resource create ioctl virtio gpu resource create ioctl calls drm gem object release on the drm gem handle create error path instead of dropping the reference it owns, so obj-funcs-free...

PT-2026-116828

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An object leak occurs in the drm/virtio component when the drm gem handle create function fails. The virtio gpu gem create function incorrectly calls drm gem object release instead of...

PT-2026-116727

Name of the Vulnerable Software and Affected Versions Linux kernel version 7.2.0 Description A NULL pointer dereference occurs in the drm/virtio component. The function virtio gpu fence alloc can return NULL during memory pressure, but the caller virtio gpu init submit does not verify the return...

PT-2026-116728

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the virtio GPU driver when virtio gpu execbuffer ioctl reserves a DRM event via drm event reserve init for a ring enabled for polling. If an error occurs during...

PT-2026-116826

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the virtio gpu resource create blob ioctl function where drm gem object release is incorrectly called during error paths for virtio gpu resource assign uuid and drm ge...

PT-2026-128363

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leaks in virtio gpu resource create blob ioctl virtio gpu resource create blob ioctl calls drm gem object release on both the virtio gpu resource assign uuid and drm gem handle create error paths instead of...