Skip to content
OpenAdvisories
High · 7.8 CVE-2026-64098 EUVD-2026-45783GHSA-9phf-m556-w4xg

drm/virtio: use uninterruptible resv lock for plane updates

Published Jul 19, 2026 · Updated Oct 19, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.15 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.14 Package: linux-aws-6.17 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-6.8 Package: linux-aws-fips Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.15 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.14 Package: linux-azure-6.17 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-6.8 Package: linux-azure-7.0 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.15 Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.14 Package: linux-azure-fde-6.17 Package: linux-azure-fde-6.2 Package: linux-azure-fde-6.8 Package: linux-azure-fde-7.0 Package: linux-azure-fips Package: linux-azure-nvidia Package: linux-azure-nvidia-6.14 Package: linux-bluefield Package: linux-fips Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.15 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.14 Package: linux-gcp-6.17 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-6.8 Package: linux-gcp-7.0 Package: linux-gcp-fips Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.15 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.14 Package: linux-hwe-6.17 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-6.8 Package: linux-hwe-7.0 Package: linux-hwe-edge Package: linux-ibm Package: linux-ibm-5.15 Package: linux-ibm-6.8 Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-intel-iotg Package: linux-intel-iotg-5.15 Package: linux-kvm Package: linux-lowlatency Package: linux-lowlatency-hwe-5.15 Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-lowlatency-hwe-6.8 Package: linux-nvidia Package: linux-nvidia-6.11 Package: linux-nvidia-6.17 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-nvidia-6.8 Package: linux-nvidia-7.0 Package: linux-nvidia-bos Package: linux-nvidia-lowlatency Package: linux-nvidia-tegra Package: linux-nvidia-tegra-5.15 Package: linux-nvidia-tegra-igx Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.14 Package: linux-oem-6.17 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oem-7.0 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.15 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.14 Package: linux-oracle-6.17 Package: linux-oracle-6.5 Package: linux-oracle-6.8 Package: linux-oracle-7.0 Package: linux-raspi Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-realtime-6.14 Package: linux-realtime-6.17 Package: linux-realtime-6.8 Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.15 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.14 Package: linux-riscv-6.17 Package: linux-riscv-6.5 Package: linux-riscv-6.8 Package: linux-riscv-7.0 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Package: linux-xilinx Package: linux-xilinx-zynqmp Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: use uninterruptible resv lock for plane updates

virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() lock
the framebuffer BO's dma_resv via virtio_gpu_array_lock_resv() and
ignore its return value. The function can fail with -EINTR from
dma_resv_lock_interruptible() (signal during lock wait) or with
-ENOMEM from dma_resv_reserve_fences() (fence slot allocation),
leaving the resv lock not held. The queue path then walks the object
array and calls dma_resv_add_fence(), which requires the lock held;
with lockdep enabled this trips dma_resv_assert_held():

WARNING: drivers/dma-buf/dma-resv.c:296 at dma_resv_add_fence+0x71e/0x840
Call Trace:
virtio_gpu_array_add_fence
virtio_gpu_queue_ctrl_sgs
virtio_gpu_queue_fenced_ctrl_buffer
virtio_gpu_cursor_plane_update
drm_atomic_helper_commit_planes
drm_atomic_helper_commit_tail
commit_tail
drm_atomic_helper_commit
drm_atomic_commit
drm_atomic_helper_update_plane
__setplane_atomic
drm_mode_cursor_universal
drm_mode_cursor_common
drm_mode_cursor_ioctl
drm_ioctl
__x64_sys_ioctl

Beyond the WARN, mutating the dma_resv fence list without the lock
races with concurrent readers/writers and can corrupt the list.

Both call sites run inside the .atomic_update plane callback, which
DRM atomic helpers do not allow to fail (by the time it runs, the
commit has been signed off to userspace and there is no clean
rollback path). Moving the lock acquisition to .prepare_fb was
rejected because the broader lock scope deadlocks against other BO
locking paths in the same atomic commit.

Introduce virtio_gpu_lock_one_resv_uninterruptible() that uses
dma_resv_lock() instead of dma_resv_lock_interruptible(). This
eliminates the -EINTR failure mode -- the realistic syzbot trigger
-- without extending the lock hold across the commit. The helper
locks a single BO and rejects nents > 1 with -EINVAL; both fix
sites lock exactly one BO.

Use it from virtio_gpu_cursor_plane_update() and
virtio_gpu_resource_flush(); check the return value to handle the
remaining -ENOMEM case from dma_resv_reserve_fences() by freeing
the objs and skipping the plane update for that frame. The
framebuffer BOs touched here are not shared with other contexts
and lock contention is expected to be brief, so the loss of
signal-interruptibility is acceptable.

Other callers of virtio_gpu_array_lock_resv() (the ioctl paths)
continue to use the interruptible variant.

The bug was reported by syzbot, triggered via fault injection
(fail_nth) on the DRM_IOCTL_MODE_CURSOR path, which forces the
-ENOMEM branch in dma_resv_reserve_fences().

Affected products

VendorProductAffectedFixed
Linux Linux 5.7 6.1.175

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 7.0.12-1 —
Debian 13 linux 6.12.94-1 —
Debian 12 linux 6.1.176-1 —
ReleasePackageFixed inAdvisory
Ubuntu Nvidia-BlueField 24.04 LTS linux-bluefield 6.8.0-1030.35 —
Ubuntu Nvidia-BlueField 22.04 LTS linux-bluefield No fix yet —
Ubuntu 26.04 LTS linux 7.0.0-28.28 —
Ubuntu 26.04 LTS linux-aws +2 7.0.0-1009.9 USN-8618-1, USN-8603-1
Ubuntu 26.04 LTS linux-gcp +1 7.0.0-1008.8 USN-8593-1
Ubuntu 26.04 LTS linux-gke 7.0.0-1003.4 —
Ubuntu 26.04 LTS linux-ibm +1 7.0.0-1010.10 USN-8603-1, USN-8593-1
Ubuntu 26.04 LTS linux-nvidia 7.0.0-1016.16 USN-8663-1
Ubuntu 26.04 LTS linux-nvidia-bos 7.0.0-2016.16 USN-8664-1
Ubuntu 26.04 LTS linux-raspi 7.0.0-1015.15 USN-8618-1
Ubuntu 26.04 LTS linux-riscv +1 7.0.0-28.28.1 —
Ubuntu 24.04 LTS linux 6.8.0-139.139 USN-8729-1
Ubuntu 24.04 LTS linux-aws 6.8.0-1064.67 USN-8729-6
Ubuntu 24.04 LTS linux-azure-7.0 7.0.0-1014.14~24.04.1 USN-8728-2
Ubuntu 24.04 LTS linux-azure-fde 6.8.0-1065.72 —
Ubuntu 24.04 LTS linux-azure-fde-7.0 7.0.0-1013.13~24.04.1 —
Ubuntu 24.04 LTS linux-gcp +1 6.8.0-1067.75 USN-8761-1, USN-8729-1
Ubuntu 24.04 LTS linux-gcp-7.0 +1 7.0.0-1011.11~24.04.1 USN-8728-3, USN-8728-1
Ubuntu 24.04 LTS linux-gke 6.8.0-1062.70 USN-8729-1
Ubuntu 24.04 LTS linux-gkeop 6.8.0-1049.53 USN-8729-1
Ubuntu 24.04 LTS linux-hwe-7.0 7.0.0-28.28~24.04.1 —
Ubuntu 24.04 LTS linux-ibm 6.8.0-1064.65 USN-8729-3
Ubuntu 24.04 LTS linux-lowlatency 6.8.0-139.139.1 USN-8729-4
Ubuntu 24.04 LTS linux-nvidia 6.8.0-1062.65 USN-8729-1
Ubuntu 24.04 LTS linux-nvidia-7.0 7.0.0-1016.16~24.04.1 USN-8663-1
Ubuntu 24.04 LTS linux-nvidia-lowlatency 6.8.0-1062.65.1 USN-8729-1
Ubuntu 24.04 LTS linux-nvidia-tegra 6.8.0-1035.38 USN-8781-1
Ubuntu 24.04 LTS linux-oracle 6.8.0-1061.64 USN-8802-1
Ubuntu 24.04 LTS linux-raspi 6.8.0-1064.68 USN-8729-1
Ubuntu 24.04 LTS linux-riscv +28 No fix yet —
Ubuntu 24.04 LTS linux-riscv-7.0 7.0.0-28.28.1~24.04.3 —
Ubuntu 24.04 LTS linux-vmware 6.8.0-1008.8 —
Ubuntu 24.04 LTS linux-xilinx 6.8.0-1036.37 USN-8729-3
Ubuntu 22.04 LTS linux +49 No fix yet —
Ubuntu 22.04 LTS linux-aws-6.8 6.8.0-1064.67~22.04.1 USN-8729-6
Ubuntu 22.04 LTS linux-azure-fde-6.8 6.8.0-1065.72~22.04.1 —
Ubuntu 22.04 LTS linux-gcp-6.8 +1 6.8.0-1067.75~22.04.1 USN-8761-3, USN-8729-3
Ubuntu 22.04 LTS linux-hwe-6.8 6.8.0-149.149~22.04.1 USN-9066-1
Ubuntu 22.04 LTS linux-ibm-6.8 6.8.0-1066.67~22.04.1 USN-8906-1
Ubuntu 22.04 LTS linux-lowlatency-hwe-6.8 6.8.0-139.139.1~22.04.1 USN-8729-4
Ubuntu 22.04 LTS linux-nvidia-6.8 6.8.0-1062.65~22.04.1 USN-8729-1
Ubuntu 22.04 LTS linux-oracle-6.8 6.8.0-1061.64~22.04.1 USN-8802-1
Ubuntu 22.04 LTS linux-riscv-6.8 6.8.0-139.139~22.04.1 —
Show 9 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Ubuntu Pro Realtime 24.04 LTS linux-raspi-realtime 6.8.0-2053.55 USN-8729-2
Ubuntu Pro Realtime 24.04 LTS linux-realtime 6.8.1-1059.60 USN-8729-1
Ubuntu Pro Realtime 24.04 LTS linux-realtime-6.14 +1 No fix yet —
Ubuntu Pro Realtime 22.04 LTS linux-realtime +1 No fix yet —
Ubuntu Pro Realtime 22.04 LTS linux-realtime-6.8 6.8.1-1059.60~22.04.1 USN-8729-1
Ubuntu Pro FIPS-updates 24.04 LTS linux-aws-fips 6.8.0-1064.67+fips1 USN-8729-5
Ubuntu Pro FIPS-updates 24.04 LTS linux-fips 6.8.0-139.139+fips1 USN-8729-1
Ubuntu Pro FIPS-updates 24.04 LTS linux-gcp-fips +1 6.8.0-1067.75+fips1 USN-8761-2, USN-8729-1
Ubuntu Pro FIPS-updates 22.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS-preview 22.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro 20.04 LTS linux-aws-5.15 +10 No fix yet —
ReleasePackageFixed inAdvisory
RHEL 10 rv +76 6.12.0-211.60.1.el10_2 RHSA-2026:71602
RHEL 9 rv +75 5.14.0-687.52.1.el9_8 RHSA-2026:71700

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 rv +74 6.12.0-211.60.1.el10_2 ALSA-2026:71602
AlmaLinux 9 rv +73 5.14.0-687.52.1.el9_8 ALSA-2026:71700

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 kernel 6.12.0-211.60.1.el10_2 RLSA-2026:71602
Rocky Linux 9 kernel 5.14.0-687.52.1.el9_8 RLSA-2026:71700
ReleasePackageFixed inAdvisory
SLES 15 SP7 kernel-64kb +7 6.4.0-150700.53.81.1 SUSE-SU-2026:4254-1
SLES 15 SP7 kernel-default-base 6.4.0-150700.53.81.1.150700.17.45.1 SUSE-SU-2026:4254-1
SLES 15 SP6 kernel-64kb +6 6.4.0-150600.23.135.1 SUSE-SU-2026:4369-1
SLES 15 SP6 kernel-default-base 6.4.0-150600.23.135.1.150600.12.62.4 SUSE-SU-2026:4369-1
SLES 15 SP5 kernel-64kb +6 5.14.21-150500.55.189.1 SUSE-SU-2026:4595-1
SLES 15 SP5 kernel-default-base 5.14.21-150500.55.189.1.150500.6.87.4 SUSE-SU-2026:4595-1
SLES 15 SP4 kernel-64kb +2 5.14.21-150400.24.240.2 SUSE-SU-2026:4284-1
SLES 15 SP4 kernel-default-base 5.14.21-150400.24.240.2.150400.24.120.2 SUSE-SU-2026:4284-1
SLES 15 SP4 kernel-docs +3 5.14.21-150400.24.240.1 SUSE-SU-2026:4284-1
Show 18 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 kernel-64kb +8 6.12.0-160000.38.1 SUSE-SU-2026:23902-1
SLES for SAP 16.0 kernel-default-base 6.12.0-160000.38.1.160000.2.23 SUSE-SU-2026:23902-1
SLES for SAP 15 SP6 kernel-default-base 6.4.0-150600.23.135.1.150600.12.62.4 SUSE-SU-2026:4369-1
SLES for SAP 15 SP6 kernel-docs +4 6.4.0-150600.23.135.1 SUSE-SU-2026:4369-1
SLES for SAP 15 SP5 kernel-default-base 5.14.21-150500.55.189.1.150500.6.87.4 SUSE-SU-2026:4595-1
SLES for SAP 15 SP5 kernel-docs +4 5.14.21-150500.55.189.1 SUSE-SU-2026:4595-1
SLES for SAP 15 SP4 kernel-default 5.14.21-150400.24.240.2 SUSE-SU-2026:4284-1
SLES for SAP 15 SP4 kernel-default-base 5.14.21-150400.24.240.2.150400.24.120.2 SUSE-SU-2026:4284-1
SLES for SAP 15 SP4 kernel-docs +3 5.14.21-150400.24.240.1 SUSE-SU-2026:4284-1
SLES 16.0 kernel-64kb +8 6.12.0-160000.38.1 SUSE-SU-2026:23902-1, SUSE-SU-2026:23897-1
SLES 16.0 kernel-default-base 6.12.0-160000.38.1.160000.2.23 SUSE-SU-2026:23902-1
SLE Micro 6.2 kernel-default-base 6.12.0-160000.38.1.160000.2.23 SUSE-SU-2026:23887-1
SLE Micro 6.2 kernel-rt +5 6.12.0-160000.38.1 SUSE-SU-2026:23887-1, SUSE-SU-2026:23881-1
SLE Micro 6.1 kernel-default-base 6.4.0-52.1.21.34 SUSE-SU-2026:23529-1
SLE Micro 6.1 kernel-rt +4 6.4.0-52.1 SUSE-SU-2026:23529-1, SUSE-SU-2026:23528-1
SLE Micro 6.0 kernel-default-base 6.4.0-52.1.21.36 SUSE-SU-2026:23481-1
SLE Micro 6.0 kernel-rt +4 6.4.0-52.1 SUSE-SU-2026:23481-1, SUSE-SU-2026:23477-1
SLE Micro 5.5 kernel-default-base 5.14.21-150500.55.189.1.150500.6.87.4 SUSE-SU-2026:4595-1
SLE Micro 5.5 kernel-rt +1 5.14.21-150500.13.161.1 SUSE-SU-2026:4347-1
SLE Micro 5.5 kernel-source +1 5.14.21-150500.55.189.1 SUSE-SU-2026:4595-1
SLE Micro 5.4 kernel-default 5.14.21-150400.24.240.2 SUSE-SU-2026:4284-1
SLE Micro 5.4 kernel-default-base 5.14.21-150400.24.240.2.150400.24.120.2 SUSE-SU-2026:4284-1
SLE Micro 5.4 kernel-rt +1 5.14.21-150400.15.186.1 SUSE-SU-2026:4279-1
SLE Micro 5.4 kernel-source 5.14.21-150400.24.240.1 SUSE-SU-2026:4284-1
SLE Micro 5.3 kernel-default 5.14.21-150400.24.240.2 SUSE-SU-2026:4284-1
SLE Micro 5.3 kernel-default-base 5.14.21-150400.24.240.2.150400.24.120.2 SUSE-SU-2026:4284-1
SLE Micro 5.3 kernel-rt +1 5.14.21-150400.15.186.1 SUSE-SU-2026:4279-1
SLE Micro 5.3 kernel-source 5.14.21-150400.24.240.1 SUSE-SU-2026:4284-1
SLE Live Patching 15 SP7 kernel-default 6.4.0-150700.53.81.1 SUSE-SU-2026:4254-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7-RT_Update_20 1-150700.1.3.1 SUSE-SU-2026:4120-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_21 1-150700.15.3.1 SUSE-SU-2026:4254-1
SLE Live Patching 15 SP6 kernel-default 6.4.0-150600.23.135.1 SUSE-SU-2026:4369-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_31 1-150600.13.3.4 SUSE-SU-2026:4369-1
SLE Live Patching 15 SP5 kernel-default 5.14.21-150500.55.189.1 SUSE-SU-2026:4595-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_45 1-150500.11.5.3 SUSE-SU-2026:4595-1
SLE Live Patching 15 SP4 kernel-default 5.14.21-150400.24.240.2 SUSE-SU-2026:4284-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_59 1-150400.9.5.1 SUSE-SU-2026:4284-1
SLE HPC 15 SP5 kernel-64kb +5 5.14.21-150500.55.189.1 SUSE-SU-2026:4595-1
SLE HPC 15 SP5 kernel-default-base 5.14.21-150500.55.189.1.150500.6.87.4 SUSE-SU-2026:4595-1
SLE HPC 15 SP4 kernel-64kb +1 5.14.21-150400.24.240.2 SUSE-SU-2026:4284-1
SLE HPC 15 SP4 kernel-default-base 5.14.21-150400.24.240.2.150400.24.120.2 SUSE-SU-2026:4284-1
SLE HPC 15 SP4 kernel-docs +3 5.14.21-150400.24.240.1 SUSE-SU-2026:4284-1
SUSE Real Time Module 15 SP7 kernel-rt +2 6.4.0-150700.7.75.1 SUSE-SU-2026:4120-1
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 kernel-default-base 6.12.0-160000.38.1.160000.2.22 openSUSE-SU-2026:21910-1
openSUSE Leap 16.0 kernel-rt +11 6.12.0-160000.38.1 openSUSE-SU-2026:21910-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 kernel-livepatch-6.18.35-68.127 +2 1:1.0-0.amzn2023 ALAS2023-2026-1894, ALAS2023-2026-1882, ALAS2023-2026-1881
Amazon Linux 2023 perf +11 1:6.1.175-219.357.amzn2023 ALAS2023-2026-1882
Amazon Linux 2023 perf6.12 +11 1:6.12.92-122.166.amzn2023 ALAS2023-2026-1894
Amazon Linux 2023 perf6.18 +12 1:6.18.35-68.127.amzn2023 ALAS2023-2026-1881

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 rv +29 6.12.0-211.60.1.el10_2 ELSA-2026-71602
Oracle Linux 9 rv +28 5.14.0-687.52.1.el9_8 ELSA-2026-71700
Oracle Linux 8 bpftool +18 5.15.0-324.217.5.2.el9uek ELSA-2026-500377, ELSA-2026-500249

Advisories 50

References