Skip to content
Heist/ feed
High

drm/virtio: use uninterruptible resv lock for plane updates

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use uninterruptible resv lock for plane updates virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() lock the framebuffer BO's dma_resv via virtio_gpu_array_lock_resv() and ignore its return value. The function can fail with -EINTR from dma_resv_lock_interruptible() (signal during lock wait) or with -ENOMEM from dma_resv_reserve_fences() (fence slot allocation), leaving the resv lock not held. The queue path then walks the object array and calls dma_resv_add_fence(), which requires the lock held; with lockdep enabled this trips dma_resv_assert_held(): WARNING: drivers/dma-buf/dma-resv.c:296 at dma_resv_add_fence+0x71e/0x840 Call Trace: virtio_gpu_array_add_fence virtio_gpu_queue_ctrl_sgs virtio_gpu_queue_fenced_ctrl_buffer virtio_gpu_cursor_plane_update drm_atomic_helper_commit_planes drm_atomic_helper_commit_tail commit_tail drm_atomic_helper_commit drm_atomic_commit drm_atomic_helper_update_plane __setplane_atomic drm_mode_cursor_universal drm_mode_cursor_common drm_mode_cursor_ioctl drm_ioctl __x64_sys_ioctl Beyond the WARN, mutating the dma_resv fence list without the lock races with concurrent readers/writers and can corrupt the list. Both call sites run inside the .atomic_update plane callback, which DRM atomic helpers do not allow to fail (by the time it runs, the commit has been signed off to userspace and there is no clean rollback path). Moving the lock acquisition to .prepar

Announced Source revision 1
Original source ↗

CVE-2026-64098

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-64098

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5cfd31c5b3a321aed0c9621b7b45efa2942056f8",
        "lessThan": "c86077d512ee980cc91322211d35dbcd3175f64c",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "5cfd31c5b3a321aed0c9621b7b45efa2942056f8",
        "lessThan": "21ab64c77a30d56efc506c8fa2ad8959f8ce3d36",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "5cfd31c5b3a321aed0c9621b7b45efa2942056f8",
        "lessThan": "7930eee22cd3df61e85be8aa512032ab303b7167",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "5cfd31c5b3a321aed0c9621b7b45efa2942056f8",
        "lessThan": "8fadd01cf461fee5bb11506621339c548447e5c7",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "5cfd31c5b3a321aed0c9621b7b45efa2942056f8",
        "lessThan": "a2359a411b15f495d12cfda6a7db6855ebb7f90f",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "5cfd31c5b3a321aed0c9621b7b45efa2942056f8",
        "lessThan": "9af1b6e175c82daf4b423da339a722d8e67a735a",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/gpu/drm/virtio/virtgpu_drv.h",
      "drivers/gpu/drm/virtio/virtgpu_gem.c",
      "drivers/gpu/drm/virtio/virtgpu_plane.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.7"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.7",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.1.175",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.142",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.92",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.34",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.0.11",
        "versionType": "semver",
        "lessThanOrEqual": "7.0.*"
      },
      {
        "status": "unaffected",
        "version": "7.1",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/gpu/drm/virtio/virtgpu_drv.h",
      "drivers/gpu/drm/virtio/virtgpu_gem.c",
      "drivers/gpu/drm/virtio/virtgpu_plane.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-64098

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#40951 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement