CVE-2026-98404 - Vulnerability Details

- drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()

Smatch complains that returning a NULL here will lead to a NULL pointer
dereference in drm_mode_addfb2(). Return an error pointer instead.

Published: 2026-10-14

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw in the Linux kernel’s DRM subsystem, a CWE‑476 (NULL Pointer Dereference), caused virtio_gpu_user_framebuffer_create() to return a NULL pointer instead of an error pointer. When this NULL value is later passed to drm_mode_addfb2(), a null pointer dereference can occur, potentially crashing the kernel and denying service to users.

Affected Systems

Linux kernel releases that contain the virtio GPU driver before the fix were achieved by commit 07de0b31dd64094cd7d25729beaf2ecae74daa72. Subsequent kernel versions that include this commit or later are not affected; the exact affected version range is not specified in the provided information.

Risk and Exploitability

The vulnerability does not provide a known remote code execution or privilege escalation path. The CVSS score is 5.5, indicating a moderate severity. The EPSS score is below 1% and the flaw is not listed in the CISA KEV catalog. The bug triggers during framebuffer creation and can result in a kernel crash, exposing the system to denial of service if the offending process is able to request a framebuffer on the affected machine.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`dc5698e80cf724770283e10414054662bdf6ccfa`	affected	< 975f3cf302bb7d7336df4c630a7c07e12780ad10
`dc5698e80cf724770283e10414054662bdf6ccfa`	affected	< 07de0b31dd64094cd7d25729beaf2ecae74daa72
`dc5698e80cf724770283e10414054662bdf6ccfa`	affected	< 5eda6cda0031ba17559d56882353be39e568ec09
`dc5698e80cf724770283e10414054662bdf6ccfa`	affected	< 3fe8a33715265ecb24ca0bcd0a575c926da4277c
`dc5698e80cf724770283e10414054662bdf6ccfa`	affected	< 974845d2535a250b180e62f9ed50284f312c01a3
`dc5698e80cf724770283e10414054662bdf6ccfa`	affected	< 45dc2788a5b0e1e2824d1f98af521bd3acc340d7
`dc5698e80cf724770283e10414054662bdf6ccfa`	affected	< f1050a7d365283678b253828739d3866ae546a72
`dc5698e80cf724770283e10414054662bdf6ccfa`	affected	< 94579f24e2b526a04eb41050af0ba018c6f528e7

Linux

affected

Version	Status	Constraints
`4.2`	affected	—
`0`	unaffected	< 4.2
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2.7`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[dc5698e80cf724770283e10414054662bdf6ccfa,975f3cf302bb7d7336df4c630a7c07e12780ad10)`	affected	code_commit	—
`[dc5698e80cf724770283e10414054662bdf6ccfa,07de0b31dd64094cd7d25729beaf2ecae74daa72)`	affected	code_commit	—
`[dc5698e80cf724770283e10414054662bdf6ccfa,3fe8a33715265ecb24ca0bcd0a575c926da4277c)`	affected	code_commit	—
`[dc5698e80cf724770283e10414054662bdf6ccfa,5eda6cda0031ba17559d56882353be39e568ec09)`	affected	code_commit	—
`[dc5698e80cf724770283e10414054662bdf6ccfa,974845d2535a250b180e62f9ed50284f312c01a3)`	affected	code_commit	—
`[dc5698e80cf724770283e10414054662bdf6ccfa,45dc2788a5b0e1e2824d1f98af521bd3acc340d7)`	affected	code_commit	—
`[dc5698e80cf724770283e10414054662bdf6ccfa,f1050a7d365283678b253828739d3866ae546a72)`	affected	code_commit	—
`[dc5698e80cf724770283e10414054662bdf6ccfa,94579f24e2b526a04eb41050af0ba018c6f528e7)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.2`	affected	generic	—
`[0,4.2)`	unaffected	generic	—
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2.7,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a Linux kernel update that incorporates the fix for virtio_gpu_user_framebuffer_create(), such as updating to a kernel containing commit 07de0b31dd64094cd7d25729beaf2ecae74daa72 or later.
Reboot the system after the kernel update to ensure the new kernel image and driver are loaded.
If an immediate kernel update is unavailable, consider limiting the use of the virtio GPU driver—for example, by disabling framebuffer creation for untrusted users or applying policy restrictions that deny write access to the DRM device.

Generated by OpenCVE AI on October 16, 2026 at 23:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4841-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00216.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98404.mbox
https://git.kernel.org/stable/c/07de0b31dd64094cd7d25729beaf2ecae74daa72
https://git.kernel.org/stable/c/3fe8a33715265ecb24ca0bcd0a575c926da4277c
https://git.kernel.org/stable/c/45dc2788a5b0e1e2824d1f98af521bd3acc340d7
https://git.kernel.org/stable/c/5eda6cda0031ba17559d56882353be39e568ec09
https://git.kernel.org/stable/c/94579f24e2b526a04eb41050af0ba018c6f528e7
https://git.kernel.org/stable/c/974845d2535a250b180e62f9ed50284f312c01a3
https://git.kernel.org/stable/c/975f3cf302bb7d7336df4c630a7c07e12780ad10
https://git.kernel.org/stable/c/f1050a7d365283678b253828739d3866ae546a72
https://nvd.nist.gov/vuln/detail/CVE-2026-98404
https://www.cve.org/CVERecord?id=CVE-2026-98404

History

Thu, 15 Oct 2026 23:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-690

Thu, 15 Oct 2026 13:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98404.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98404 https://www.cve.org/CVERecord?id=CVE-2026-98404
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Thu, 15 Oct 2026 04:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-690

Wed, 14 Oct 2026 13:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() Smatch complains that returning a NULL here will lead to a NULL pointer dereference in drm_mode_addfb2(). Return an error pointer instead.
Title		drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/07de0b31dd64094cd7d25729beaf2ecae74daa72 https://git.kernel.org/stable/c/3fe8a33715265ecb24ca0bcd0a575c926da4277c https://git.kernel.org/stable/c/45dc2788a5b0e1e2824d1f98af521bd3acc340d7 https://git.kernel.org/stable/c/5eda6cda0031ba17559d56882353be39e568ec09 https://git.kernel.org/stable/c/94579f24e2b526a04eb41050af0ba018c6f528e7 https://git.kernel.org/stable/c/974845d2535a250b180e62f9ed50284f312c01a3 https://git.kernel.org/stable/c/975f3cf302bb7d7336df4c630a7c07e12780ad10 https://git.kernel.org/stable/c/f1050a7d365283678b253828739d3866ae546a72

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-14T13:26:03.510Z

Updated: 2026-10-19T09:18:57.630Z

Reserved: 2026-09-25T10:25:14.347Z

Link: CVE-2026-98404

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-14T14:17:51.483

Modified: 2026-10-19T10:18:45.360

Link: CVE-2026-98404

Redhat

Severity : Low

Publid Date: 2026-10-14T00:00:00Z

Links: CVE-2026-98404 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-19T17:15:06Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object