CVE-2026-98509

A flaw was found in the Linux kernel's virtio graphics processing unit (virtio-gpu) driver. A local user can cause a Denial of Service (DoS) by triggering a kernel memory leak during graphics command buffer processing. When invalid submission parameters are provided, the driver's error-handling path fails to cancel and release pre-allocated event objects, permanently stranding kernel memory. Repeated exploitation can deplete system memory resources, resulting in system instability or crashes.

This vulnerability is rated as Low severity because exploitation is restricted to authenticated local users on virtualized guest environments with access to the virtio-gpu device node. The flaw only causes unreferenced memory allocations to persist within kernel space following malformed submission calls, without offering privilege escalation or data exposure. In typical Red Hat Enterprise Linux server deployments, virtio-gpu devices are either absent or unexposed to unprivileged accounts, significantly bounding the practical denial-of-service risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.