CVE-2026-64098 Linux CVE debrief

Who should care

Users of Linux kernel with drm/virtio are potentially affected by this vulnerability. Specifically, operators and security teams responsible for Linux kernel deployments using drm/virtio should review their system's exposure and apply the provided kernel patches. Additionally, platform administrators and vulnerability management teams should be aware of the potential impact and plan for mitigations if necessary.

Technical summary

The Linux kernel's drm/virtio has a vulnerability where virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() lock the framebuffer BO's dma_resv via virtio_gpu_array_lock_resv() and ignore its return value. This can lead to the resv lock not being held, causing a WARNING and potentially corrupting the dma_resv fence list. The vulnerability is triggered by the failure of dma_resv_lock_interruptible() or dma_resv_reserve_fences(), which can return -EINTR or -ENOMEM respectively. To address this, a new function virtio_gpu_lock_one_resv_uninterruptible() is introduced, which uses dma_resv_lock() instead of dma_resv_lock_interruptible(). This eliminates the -EINTR failure mode without extending the lock hold across the commit.

Defensive priority

Medium priority for Linux kernel users with drm/virtio enabled. Defenders should prioritize patching and verifying the integrity of their Linux kernel deployments.

Recommended defensive actions

• Review and apply the provided kernel patches
• Inventory and update affected Linux kernel versions
• Monitor for potential exploit attempts
• Verify that Linux kernel versions match the patched versions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The bug was reported by syzbot, triggered via fault injection (fail_nth) on the DRM_IOCTL_MODE_CURSOR path, which forces the -ENOMEM branch in dma_resv_reserve_fences(). The syzbot reproduction case is not publicly available, but it demonstrates the potential for local attackers to trigger the failure mode. Defenders should verify that their Linux kernel versions match the patched versions and review their system's exposure to this vulnerability.

Official resources