Executive brief
A vulnerability was identified in the Linux kernel's VirtIO GPU driver, which is used to provide graphics support in virtualized environments. Under specific conditions, the system may fail to properly lock internal memory structures during screen updates, potentially leading to system instability or crashes. This issue primarily affects the reliability of the virtualized display system and could be used to cause a denial-of-service on the guest operating system.
Technical details
A vulnerability in the virtio_gpu driver arises because virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() fail to check the return value of virtio_gpu_array_lock_resv(). This function can return -EINTR or -ENOMEM, leaving the dma_resv lock unheld. Subsequent calls to dma_resv_add_fence() proceed without the required lock, leading to a race condition that can corrupt the dma_resv fence list. The fix introduces an uninterruptible locking helper to eliminate -EINTR failures and adds proper error handling for -ENOMEM scenarios. This issue was discovered via syzbot fault injection.
Affected products
- Linux Linux Kernel virtio_gpu driver
Timeline
- 2026-05-19: disclosed: Initial patch submitted by developer
- 2026-06-01: patched: Patch committed to stable tree
- 2026-07-19: advisory: CVE published
References
- https://git.kernel.org/stable/c/21ab64c77a30d56efc506c8fa2ad8959f8ce3d36
- https://git.kernel.org/stable/c/7930eee22cd3df61e85be8aa512032ab303b7167
- https://git.kernel.org/stable/c/8fadd01cf461fee5bb11506621339c548447e5c7
- https://git.kernel.org/stable/c/9af1b6e175c82daf4b423da339a722d8e67a735a
- https://git.kernel.org/stable/c/a2359a411b15f495d12cfda6a7db6855ebb7f90f
- https://git.kernel.org/stable/c/c86077d512ee980cc91322211d35dbcd3175f64c