In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()… (CVE-2026-98607)

The vulnerability in the Linux kernel's drm/virtio subsystem involves the virtio_gpu_resource_create_blob_ioctl() function improperly managing object references on error paths. Specifically, it calls drm_gem_object_release() instead of drm_gem_object_put(), which prevents the object's free function from executing. This results in leaks of the virtio_gpu_object, the resource ID, and the host-side resource. The fix replaces drm_gem_object_release() with drm_gem_object_put() to properly drop the reference and avoid leaks.

The vulnerability causes resource leaks in the Linux kernel's graphics virtualization component, potentially leading to increased memory consumption and resource exhaustion. There is no indication of direct code execution or privilege escalation from the provided data. No known exploits are reported in the wild.

This vulnerability has been resolved in the Linux kernel by correcting the reference handling in virtio_gpu_resource_create_blob_ioctl(). Users should apply the official kernel updates that include this fix. Patch status is not explicitly stated in the provided data; therefore, check the vendor advisory for current remediation guidance.