Executive brief
A vulnerability in the Linux kernel's virtio-gpu driver can cause a system crash when the driver is removed or unbound. This occurs specifically when the driver is built with Kernel Mode Setting (KMS) disabled, leading the system to access uninitialized memory. An exploit could result in a denial-of-service by crashing the host or virtual machine.
Technical details
A vulnerability in the virtio-gpu driver (drivers/gpu/drm/virtio/virtgpu_drv.c) exists when the driver is compiled with KMS support disabled. In this configuration, DRM atomic and modesetting structures are not initialized. However, the driver removal path (virtio_gpu_remove) still attempts to call drm_atomic_helper_shutdown(), which accesses this uninitialized data, resulting in a kernel panic. The fix introduces a check using drm_core_check_feature(dev, DRIVER_ATOMIC) to ensure shutdown procedures are only called if the atomic core was actually initialized. This issue affects Linux kernel versions from 6.4 up to 7.1.
Affected products
- Linux Linux Kernel 6.4 to 7.1
Timeline
- 2026-07-01: disclosed
- 2026-07-01: advisory
References
- https://git.kernel.org/stable/c/15e561869a8b4e4db69733be1d6f33770664f989
- https://git.kernel.org/stable/c/19a6a00ff50c284f3a9818882ad2be58b33b790a
- https://git.kernel.org/stable/c/38a5f891cda6d121c149c94cda89c31ec7024ee3
- https://git.kernel.org/stable/c/ed3e134700a2e07caa99b9bc0683ebbe0327c562
- https://git.kernel.org/stable/c/f329e8325e054bd6d84d10904f8dd51137281b92