CVE-2026-98508

A flaw was found in the Linux kernel's VirtIO GPU driver. This flaw allows a local user to cause a denial of service (DoS) by triggering a kernel crash. Under memory pressure, the driver fails to verify whether fence memory allocation succeeds during graphics command submission, leading to an unchecked NULL pointer dereference.

This vulnerability is evaluated as having Moderate impact because triggering it requires local authenticated access under specific memory exhaustion conditions and only leads to a kernel crash (denial of service), without permitting privilege escalation or data exposure. The flaw strictly affects virtual machine guests configured with an emulated VirtIO display device. Physical bare-metal environments and virtual instances operating headless or with alternative virtual graphics adapters remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.