GHSA-CCH7-4W9V-52Q8
Vulnerability from github – Published: 2026-10-18 18:31 – Updated: 2026-10-18 18:31In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()
virtio_gpu_resource_create_blob_ioctl() calls drm_gem_object_release() on both the virtio_gpu_resource_assign_uuid() and drm_gem_handle_create() error paths instead of dropping the reference it owns, so obj->funcs->free() never runs and the virtio_gpu_object, the resource id and the host-side resource are leaked.
Use drm_gem_object_put() instead.
{
"affected": [],
"aliases": [
"CVE-2026-98607"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-18T16:17:13Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()\n\nvirtio_gpu_resource_create_blob_ioctl() calls drm_gem_object_release() on\nboth the virtio_gpu_resource_assign_uuid() and drm_gem_handle_create()\nerror paths instead of dropping the reference it owns, so\nobj-\u003efuncs-\u003efree() never runs and the virtio_gpu_object, the resource id\nand the host-side resource are leaked.\n\nUse drm_gem_object_put() instead.",
"id": "GHSA-cch7-4w9v-52q8",
"modified": "2026-10-18T18:31:56Z",
"published": "2026-10-18T18:31:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98607"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/02df4e24dc4c0bf5b0425a6acabc5201d7f04fc2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0455867bbd95ffa9d9db0a1c6dda500f8126232c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/24b6d5c7641412c9ebef0d4c8b888d49a0e6b880"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/73ea38a89b923fa08047885a0845d1cd89261ead"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/81c6769e069d703154087377d1749af2f1b74e49"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/88c60c06a2a5244f5dd32ec098e633add114890f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/eea473532a286cd1b13cddbec5c645989f43a3aa"
}
],
"schema_version": "1.4.0",
"severity": []
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.