CVE-2026-64098

Status: UPDATED  |  Advisory ID: CVE-2026-64098

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: use uninterruptible resv lock for plane updates

virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() lock

the framebuffer BO's dma_resv via virtio_gpu_array_lock_resv() and

ignore its return value. The function can fail with -EINTR from

dma_resv_lock_interruptible() (signal during lock wait) or with

-ENOMEM from dma_resv_reserve_fences() (fence slot allocation),

leaving the resv lock not held. The queue path then walks the object

array and calls dma_resv_add_fence(), which requires the lock held;

with lockdep enabled this trips dma_resv_assert_held():

WARNING: drivers/dma-buf/dma-resv.c:296 at dma_resv_add_fence+0x71e/0x840

Call Trace:

virtio_gpu_array_add_fence

virtio_gpu_queue_ctrl_sgs

virtio_gpu_queue_fenced_ctrl_buffer

virtio_gpu_cursor_plane_update

drm_atomic_helper_commit_planes

drm_atomic_helper_commit_tail

commit_tail

drm_atomic_helper_commit

drm_atomic_commit

drm_atomic_helper_update_plane

__setplane_atomic

drm_mode_cursor_universal

drm_mode_cursor_common

drm_mode_cursor_ioctl

drm_ioctl

__x64_sys_ioctl

Beyond the WARN, mutating the dma_resv fence list without the lock

races with concurrent readers/writers and can corrupt the list.

Both call sites run inside the .atomic_update plane callback, which

DRM atomic helpers do not allow to fail (by the time it runs, the

commit has been signed off to userspace and there is no clean

rollback path). Moving the lock acquisition to .prepare_fb was

rejected because the broader lock scope deadlocks against other BO

locking paths in the same atomic commit.

Introduce virtio_gpu_lock_one_resv_uninterruptible() that uses

dma_resv_lock() instead of dma_resv_lock_interruptible(). This

eliminates the -EINTR failure mode -- the realistic syzbot trigger

-- without extending the lock hold across the commit. The helper

locks a single BO and rejects nents > 1 with -EINVAL; both fix

sites lock exactly one BO.

Use it from virtio_gpu_cursor_plane_update() and

virtio_gpu_resource_flush(); check the return value to handle the

remaining -ENOMEM case from dma_resv_reserve_fences() by freeing

the objs and skipping the plane update for that frame. The

framebuffer BOs touched here are not shared with other contexts

and lock contention is expected to be brief, so the loss of

signal-interruptibility is acceptable.

Other callers of virtio_gpu_array_lock_resv() (the ioctl paths)

continue to use the interruptible variant.

The bug was reported by syzbot, triggered via fault injection

(fail_nth) on the DRM_IOCTL_MODE_CURSOR path, which forces the

-ENOMEM branch in dma_resv_reserve_fences(). (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References