In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()… (CVE-2026-98608)

The Linux kernel's drm/virtio driver had a resource management flaw in virtio_gpu_resource_create_ioctl(). On an error path after drm_gem_handle_create() fails, drm_gem_object_release() was called instead of drm_gem_object_put(). This prevented the object's free function from executing, causing a leak of the virtio_gpu_object and associated resources such as pages, scatter-gather tables, resource IDs, and host-side resources. The vulnerability was resolved by replacing drm_gem_object_release() with drm_gem_object_put() to ensure proper resource cleanup.

The vulnerability causes a resource leak in the Linux kernel's drm/virtio GPU driver. This leak can result in increased memory and resource consumption, potentially degrading system performance or stability over time. There is no indication of direct code execution or privilege escalation from this leak. No known exploits in the wild have been reported.

A fix for this vulnerability has been implemented in the Linux kernel by correcting the resource release logic in virtio_gpu_resource_create_ioctl(). Users should apply the official kernel updates that include this fix. Since this is a resource leak, no additional mitigation steps beyond applying the patch are necessary.