PT-2026-116728 · Linux · Linux
CVE-2026-98509
·
تاريخ النشر
2026-10-18
·
تاريخ التحديث
2026-10-18
لا يوجد
لا تتوفر حاليًا تقييمات أو مقاييس للخطورة. سنحدّث المعلومات المقابلة في الصفحة فور توفرها.
In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: fix memory leak of fence event on execbuffer failure
virtio gpu execbuffer ioctl() reserves a DRM event with
drm event reserve init() when VIRTGPU EXECBUF RING IDX selects a ring that
userspace has enabled polling for. virtio gpu init submit() does this
before the BO handles, the command buffer, the syncobj arrays and the
in-fence are processed, so every later error path runs with the event
already pending, including plain argument validation failures such as an
invalid bo handle or an in-syncobj that carries no fence.
On those paths, virtio gpu cleanup submit() drops the out-fence without
cancelling the event. The fence is freed without ever having been emitted,
taking the only driver-side pointer to the event with it. Closing the DRM
file does not help. drm events release() unlinks pending events but
deliberately leaves the freeing to the driver's later drm send event(),
which never runs for an orphaned event, so the allocation is leaked
permanently.
Found when fuzzing the virtio driver with Syzkaller:
BUG: memory leak
unreferenced object 0xffff88802c176e80 (size 96):
comm "syz.1.367", pid 10561, jiffies 4294960122
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
c8 6e 17 2c 80 88 ff ff 00 00 00 00 00 00 00 00 .n.,............
backtrace (crc e1973c6b):
kmemleak alloc recursive include/linux/kmemleak.h:44 [inline]
slab post alloc hook mm/slub.c:4597 [inline]
slab alloc node mm/slub.c:4917 [inline]
kmalloc cache noprof+0x49d/0x6f0 mm/slub.c:5485
kmalloc noprof include/linux/slab.h:988 [inline]
kzalloc noprof include/linux/slab.h:1309 [inline]
virtio gpu fence event create drivers/gpu/drm/virtio/virtgpu submit.c:282 [inline]
virtio gpu init submit drivers/gpu/drm/virtio/virtgpu submit.c:398 [inline]
virtio gpu execbuffer ioctl+0xbbf/0x1aa0 drivers/gpu/drm/virtio/virtgpu submit.c:505
drm ioctl kernel+0x1f4/0x3e0 drivers/gpu/drm/drm ioctl.c:817
drm ioctl+0x5f4/0xc70 drivers/gpu/drm/drm ioctl.c:914
vfs ioctl fs/ioctl.c:51 [inline]
do sys ioctl fs/ioctl.c:597 [inline]
se sys ioctl fs/ioctl.c:583 [inline]
x64 sys ioctl+0x18e/0x210 fs/ioctl.c:583
do syscall x64 arch/x86/entry/syscall 64.c:63 [inline]
do syscall 64+0x116/0x800 arch/x86/entry/syscall 64.c:94
entry SYSCALL 64 after hwframe+0x77/0x7fFix by cancelling and freeing the DRM event on the execbuffer error path
before dropping the fence. Clear the fence's event pointer after
cancellation so it does not retain a dangling pointer.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
المعرّفات ذات الصلة
المنتجات المتأثرة
Linux