CVE-2026-53190 drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix dmafence refcount leak on error in virtiogpudmafencewait dmafenceunwrapforeach internally calls dmafenceunwrapfirst which does cursor-chain = dmafencegethead, taking an extra reference. On normal loop completion,...

CVE-2022-49532

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference in virtiogpuconngetmodes drmcvtmode may return NULL and we should check it. This bug is found by syzkaller: FAULTINJECTION stacktrace: 168.567394 FAULTINJECTION: forcing a failure. name...

OSV-2021-820 UNKNOWN READ in virtio_gpu_disable_scanout

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34831 Crash type: UNKNOWN READ Crash state: virtiogpudisablescanout virtiogpusetscanout virtiogpusimpleprocesscmd...

CVE-2017-5578

CVE-2017-5578 describes a memory leak in QEMU’s virtio-gpu resource attach path (virtio_gpu_resource_attach_backing in hw/display/virtio-gpu.c) that can be triggered by a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands, allowing a local guest to cause host memory exhaustion (DoS)....

CVE-2017-5578

Memory leak in the virtiogpuresourceattachbacking function in hw/display/virtio-gpu.c in QEMU aka Quick Emulator allows local guest OS users to cause a denial of service host memory consumption via a large number of VIRTIOGPUCMDRESOURCEATTACHBACKING commands...

CVE-2017-5578

Memory leak in the virtiogpuresourceattachbacking function in hw/display/virtio-gpu.c in QEMU aka Quick Emulator allows local guest OS users to cause a denial of service host memory consumption via a large number of VIRTIOGPUCMDRESOURCEATTACHBACKING commands...

CVE-2016-10029

The virtiogpusetscanout function in QEMU aka Quick Emulator built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service out-of-bounds read and process crash via a scanout id in a VIRTIOGPUCMDSETSCANOUT command larger than numscanouts...