In the Linux kernel, the following vulnerability has been resolved: drm/virtio: release the GEM object on virtio_gpu_vram_create() errors… (CVE-2026-98606)

The vulnerability in the Linux kernel's drm/virtio subsystem involved improper memory management in the virtio_gpu_vram_create() function. On error paths, the function freed the GEM object with kfree(vram) without first calling drm_gem_object_release(), leaving the freed object still linked in the device's VMA offset manager interval tree. This resulted in subsequent lookups or insertions accessing freed memory, and associated dma_resv and gpuva locks were never destroyed, causing resource leaks and potential instability. The fix involved calling drm_gem_object_release() before kfree() on both error paths to properly clean up resources.

The vulnerability could lead to use-after-free conditions where freed memory is accessed, potentially causing kernel instability or crashes. Additionally, locks related to DMA reservation and GPU virtual address management were not released, leading to resource leaks. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to call drm_gem_object_release() before freeing the GEM object on error paths in virtio_gpu_vram_create(). Users should update to the fixed kernel version once available. Since this is a kernel-level issue, applying the official kernel patch or upgrading to a patched kernel release is the recommended remediation.