CVE-2026-64098 - Vulnerability Details

- drm/virtio: use uninterruptible resv lock for plane updates

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: use uninterruptible resv lock for plane updates

virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() lock
the framebuffer BO's dma_resv via virtio_gpu_array_lock_resv() and
ignore its return value. The function can fail with -EINTR from
dma_resv_lock_interruptible() (signal during lock wait) or with
-ENOMEM from dma_resv_reserve_fences() (fence slot allocation),
leaving the resv lock not held. The queue path then walks the object
array and calls dma_resv_add_fence(), which requires the lock held;
with lockdep enabled this trips dma_resv_assert_held():

WARNING: drivers/dma-buf/dma-resv.c:296 at dma_resv_add_fence+0x71e/0x840
Call Trace:
virtio_gpu_array_add_fence
virtio_gpu_queue_ctrl_sgs
virtio_gpu_queue_fenced_ctrl_buffer
virtio_gpu_cursor_plane_update
drm_atomic_helper_commit_planes
drm_atomic_helper_commit_tail
commit_tail
drm_atomic_helper_commit
drm_atomic_commit
drm_atomic_helper_update_plane
__setplane_atomic
drm_mode_cursor_universal
drm_mode_cursor_common
drm_mode_cursor_ioctl
drm_ioctl
__x64_sys_ioctl

Beyond the WARN, mutating the dma_resv fence list without the lock
races with concurrent readers/writers and can corrupt the list.

Both call sites run inside the .atomic_update plane callback, which
DRM atomic helpers do not allow to fail (by the time it runs, the
commit has been signed off to userspace and there is no clean
rollback path). Moving the lock acquisition to .prepare_fb was
rejected because the broader lock scope deadlocks against other BO
locking paths in the same atomic commit.

Introduce virtio_gpu_lock_one_resv_uninterruptible() that uses
dma_resv_lock() instead of dma_resv_lock_interruptible(). This
eliminates the -EINTR failure mode -- the realistic syzbot trigger
-- without extending the lock hold across the commit. The helper
locks a single BO and rejects nents > 1 with -EINVAL; both fix
sites lock exactly one BO.

Use it from virtio_gpu_cursor_plane_update() and
virtio_gpu_resource_flush(); check the return value to handle the
remaining -ENOMEM case from dma_resv_reserve_fences() by freeing
the objs and skipping the plane update for that frame. The
framebuffer BOs touched here are not shared with other contexts
and lock contention is expected to be brief, so the loss of
signal-interruptibility is acceptable.

Other callers of virtio_gpu_array_lock_resv() (the ioctl paths)
continue to use the interruptible variant.

The bug was reported by syzbot, triggered via fault injection
(fail_nth) on the DRM_IOCTL_MODE_CURSOR path, which forces the
-ENOMEM branch in dma_resv_reserve_fences().

Published: 2026-07-19

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability resides in the virtio GPU driver where the framebuffer buffer object’s reservation lock is obtained via an interruptible call, but the return value is ignored. If the lock acquisition fails, subsequent fence addition operations attempt to modify the reservation fence list without holding the required lock. This race can corrupt the list, potentially leading to kernel crashes or data corruption. The weakness is a classic races condition (CWE‑413).

Affected Systems

Linux kernel systems that include the virtio‑gpu driver and expose the DRM_IOCTL_MODE_CURSOR or related ioctl paths. Any kernel version containing the affected virtio_gpu code before the patch is considered exposed.

Risk and Exploitability

The CVSS score of 7.8 represents high severity, while an EPSS score of < 1% indicates a very low likelihood of exploitation at the time of reporting. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is inferred from the description: an attacker may invoke the offending ioctl to trigger the flaw. Successful exploitation could cause memory corruption or crashes, leading to denial of service, but does not provide remote code execution.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5cfd31c5b3a321aed0c9621b7b45efa2942056f8`	affected	< c86077d512ee980cc91322211d35dbcd3175f64c
`5cfd31c5b3a321aed0c9621b7b45efa2942056f8`	affected	< 21ab64c77a30d56efc506c8fa2ad8959f8ce3d36
`5cfd31c5b3a321aed0c9621b7b45efa2942056f8`	affected	< 7930eee22cd3df61e85be8aa512032ab303b7167
`5cfd31c5b3a321aed0c9621b7b45efa2942056f8`	affected	< 8fadd01cf461fee5bb11506621339c548447e5c7
`5cfd31c5b3a321aed0c9621b7b45efa2942056f8`	affected	< a2359a411b15f495d12cfda6a7db6855ebb7f90f
`5cfd31c5b3a321aed0c9621b7b45efa2942056f8`	affected	< 9af1b6e175c82daf4b423da339a722d8e67a735a

Linux

affected

Version	Status	Constraints
`5.7`	affected	—
`0`	unaffected	< 5.7
`6.1.175`	unaffected	≤ 6.1.*
`6.6.142`	unaffected	≤ 6.6.*
`6.12.92`	unaffected	≤ 6.12.*
`6.18.34`	unaffected	≤ 6.18.*
`7.0.11`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5cfd31c5b3a321aed0c9621b7b45efa2942056f8,c86077d512ee980cc91322211d35dbcd3175f64c)`	affected	code_commit	—
`[5cfd31c5b3a321aed0c9621b7b45efa2942056f8,21ab64c77a30d56efc506c8fa2ad8959f8ce3d36)`	affected	code_commit	—
`[5cfd31c5b3a321aed0c9621b7b45efa2942056f8,7930eee22cd3df61e85be8aa512032ab303b7167)`	affected	code_commit	—
`[5cfd31c5b3a321aed0c9621b7b45efa2942056f8,8fadd01cf461fee5bb11506621339c548447e5c7)`	affected	code_commit	—
`[5cfd31c5b3a321aed0c9621b7b45efa2942056f8,a2359a411b15f495d12cfda6a7db6855ebb7f90f)`	affected	code_commit	—
`[5cfd31c5b3a321aed0c9621b7b45efa2942056f8,9af1b6e175c82daf4b423da339a722d8e67a735a)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.7`	affected	generic	—
`[0,5.7)`	unaffected	semver	—
`[6.1.175,6.2.0)`	unaffected	semver	—
`[6.6.142,6.7.0)`	unaffected	semver	—
`[6.12.92,6.13.0)`	unaffected	semver	—
`[6.18.34,6.19.0)`	unaffected	semver	—
`[7.0.11,7.1.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that includes the virtio_gpu_lock_one_resv_uninterruptible patch and proper error handling
If an upgrade is not immediately possible, consider disabling the virtio‑gpu driver or disabling cursor functionality in affected environments
Monitor kernel logs for dma_resv_assert_held warnings and plan for the kernel fix when available

Generated by OpenCVE AI on August 1, 2026 at 07:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00146.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/21ab64c77a30d56efc506c8fa2ad8959f8ce3d36
https://git.kernel.org/stable/c/7930eee22cd3df61e85be8aa512032ab303b7167
https://git.kernel.org/stable/c/8fadd01cf461fee5bb11506621339c548447e5c7
https://git.kernel.org/stable/c/9af1b6e175c82daf4b423da339a722d8e67a735a
https://git.kernel.org/stable/c/a2359a411b15f495d12cfda6a7db6855ebb7f90f
https://git.kernel.org/stable/c/c86077d512ee980cc91322211d35dbcd3175f64c
https://lore.kernel.org/linux-cve-announce/2026071919-CVE-2026-64098-b8ed@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64098
https://www.cve.org/CVERecord?id=CVE-2026-64098

History

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Mon, 20 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-413
References		https://lore.kernel.org/linux-cve-announce/2026071919-CVE-2026-64098-b8ed@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64098 https://www.cve.org/CVERecord?id=CVE-2026-64098
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Sun, 19 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use uninterruptible resv lock for plane updates virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() lock the framebuffer BO's dma_resv via virtio_gpu_array_lock_resv() and ignore its return value. The function can fail with -EINTR from dma_resv_lock_interruptible() (signal during lock wait) or with -ENOMEM from dma_resv_reserve_fences() (fence slot allocation), leaving the resv lock not held. The queue path then walks the object array and calls dma_resv_add_fence(), which requires the lock held; with lockdep enabled this trips dma_resv_assert_held(): WARNING: drivers/dma-buf/dma-resv.c:296 at dma_resv_add_fence+0x71e/0x840 Call Trace: virtio_gpu_array_add_fence virtio_gpu_queue_ctrl_sgs virtio_gpu_queue_fenced_ctrl_buffer virtio_gpu_cursor_plane_update drm_atomic_helper_commit_planes drm_atomic_helper_commit_tail commit_tail drm_atomic_helper_commit drm_atomic_commit drm_atomic_helper_update_plane __setplane_atomic drm_mode_cursor_universal drm_mode_cursor_common drm_mode_cursor_ioctl drm_ioctl __x64_sys_ioctl Beyond the WARN, mutating the dma_resv fence list without the lock races with concurrent readers/writers and can corrupt the list. Both call sites run inside the .atomic_update plane callback, which DRM atomic helpers do not allow to fail (by the time it runs, the commit has been signed off to userspace and there is no clean rollback path). Moving the lock acquisition to .prepare_fb was rejected because the broader lock scope deadlocks against other BO locking paths in the same atomic commit. Introduce virtio_gpu_lock_one_resv_uninterruptible() that uses dma_resv_lock() instead of dma_resv_lock_interruptible(). This eliminates the -EINTR failure mode -- the realistic syzbot trigger -- without extending the lock hold across the commit. The helper locks a single BO and rejects nents > 1 with -EINVAL; both fix sites lock exactly one BO. Use it from virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush(); check the return value to handle the remaining -ENOMEM case from dma_resv_reserve_fences() by freeing the objs and skipping the plane update for that frame. The framebuffer BOs touched here are not shared with other contexts and lock contention is expected to be brief, so the loss of signal-interruptibility is acceptable. Other callers of virtio_gpu_array_lock_resv() (the ioctl paths) continue to use the interruptible variant. The bug was reported by syzbot, triggered via fault injection (fail_nth) on the DRM_IOCTL_MODE_CURSOR path, which forces the -ENOMEM branch in dma_resv_reserve_fences().
Title		drm/virtio: use uninterruptible resv lock for plane updates
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/21ab64c77a30d56efc506c8fa2ad8959f8ce3d36 https://git.kernel.org/stable/c/7930eee22cd3df61e85be8aa512032ab303b7167 https://git.kernel.org/stable/c/8fadd01cf461fee5bb11506621339c548447e5c7 https://git.kernel.org/stable/c/9af1b6e175c82daf4b423da339a722d8e67a735a https://git.kernel.org/stable/c/a2359a411b15f495d12cfda6a7db6855ebb7f90f https://git.kernel.org/stable/c/c86077d512ee980cc91322211d35dbcd3175f64c

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T15:40:04.264Z

Updated: 2026-08-05T12:39:12.587Z

Reserved: 2026-07-19T07:54:57.033Z

Link: CVE-2026-64098

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64098 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-01T07:45:05Z

Weaknesses

CWE-413
Improper Resource Locking

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object