CVE-2026-98156 (GCVE-0-2026-98156)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:36 – Updated: 2026-09-25 14:42
VLAI
Title
drm/virtio: use the DMA API for resource backing on Xen
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use the DMA API for resource backing on Xen On a Xen PV domain page addresses bear no relation to the real machine addresses the host would have to use to reach it. virtio_ring.c handles this correctly, vring_use_map_api() returns true for any xen_domain() regardless of VIRTIO_F_ACCESS_PLATFORM. virtio-gpu makes the same decision independently, but its copy looks only at the feature bit: bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev); QEMU does not set iommu_platform on virtio-vga by default, so VIRTIO_F_ACCESS_PLATFORM is not negotiated, use_dma_api is false, and virtio_gpu_object_shmem_init() describes the framebuffer's backing pages to the host with sg_phys(). Those are guest-physical addresses. In a PV domain they resolve, on the host side, to pages belonging to some other domain, so the host scans out unrelated memory. Move the decision into virtio_gpu_use_dma_api() and give it the xen_domain() check, like vring_use_map_api() has. This additionally enables the dma_sync_sgtable_for_device() calls in virtgpu_vq.c, which are required for correctness whenever swiotlb is in play. Reproduced with a Xen 4.21 PV dom0 nested inside QEMU 8.2 with virtio-vga, on both a distro 6.8 kernel and 6.18 LTS. A PVH dom0 works fine and doesn't need this fix because it is identity-mapped, only PV dom0s are affected.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a3b815f09bb846255c458c181b8a5b1cc66891b4 , < 93c557e947ef0040004b1ac6a1c1265d79a957e1 (git)
Affected: a3b815f09bb846255c458c181b8a5b1cc66891b4 , < 455184dbe9652d01470d3c5cf5edd09a7a673a99 (git)
Affected: a3b815f09bb846255c458c181b8a5b1cc66891b4 , < 6a736d2f9d0c6e6217fe7532bc4c50ceca71db78 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.20
Unaffected: 0 , < 4.20 (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2.7 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/virtio/virtgpu_drv.h",
            "drivers/gpu/drm/virtio/virtgpu_object.c",
            "drivers/gpu/drm/virtio/virtgpu_vq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "93c557e947ef0040004b1ac6a1c1265d79a957e1",
              "status": "affected",
              "version": "a3b815f09bb846255c458c181b8a5b1cc66891b4",
              "versionType": "git"
            },
            {
              "lessThan": "455184dbe9652d01470d3c5cf5edd09a7a673a99",
              "status": "affected",
              "version": "a3b815f09bb846255c458c181b8a5b1cc66891b4",
              "versionType": "git"
            },
            {
              "lessThan": "6a736d2f9d0c6e6217fe7532bc4c50ceca71db78",
              "status": "affected",
              "version": "a3b815f09bb846255c458c181b8a5b1cc66891b4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/virtio/virtgpu_drv.h",
            "drivers/gpu/drm/virtio/virtgpu_object.c",
            "drivers/gpu/drm/virtio/virtgpu_vq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc2",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: use the DMA API for resource backing on Xen\n\nOn a Xen PV domain page addresses bear no relation to the real machine\naddresses the host would have to use to reach it.\nvirtio_ring.c handles this correctly, vring_use_map_api() returns true\nfor any xen_domain() regardless of VIRTIO_F_ACCESS_PLATFORM.\n\nvirtio-gpu makes the same decision independently, but its copy\nlooks only at the feature bit:\n\n\tbool use_dma_api = !virtio_has_dma_quirk(vgdev-\u003evdev);\n\nQEMU does not set iommu_platform on virtio-vga by default, so\nVIRTIO_F_ACCESS_PLATFORM is not negotiated, use_dma_api is false, and\nvirtio_gpu_object_shmem_init() describes the framebuffer\u0027s backing pages\nto the host with sg_phys().  Those are guest-physical addresses. In a PV\ndomain they resolve, on the host side, to pages belonging to some other\ndomain, so the host scans out unrelated memory.\n\nMove the decision into virtio_gpu_use_dma_api() and give it the\nxen_domain() check, like vring_use_map_api() has. This\nadditionally enables the dma_sync_sgtable_for_device() calls in\nvirtgpu_vq.c, which are required for correctness whenever swiotlb\nis in play.\n\nReproduced with a Xen 4.21 PV dom0 nested inside QEMU 8.2 with\nvirtio-vga, on both a distro 6.8 kernel and 6.18 LTS. A PVH dom0\nworks fine and doesn\u0027t need this fix because it is identity-mapped,\nonly PV dom0s are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker is a local process in the Xen PV dom0. It opens the virtio-gpu render node and calls VIRTGPU_RESOURCE_CREATE, which runs virtio_gpu_object_shmem_init(), and then VIRTGPU_TRANSFER_TO_HOST or TRANSFER_FROM_HOST. No remote peer supplies the bad sg_phys() addresses; the guest driver builds them itself.\nAC:H - The bug only exists on a Xen PV dom0 nested inside QEMU with virtio-vga and without iommu_platform, so VIRTIO_F_ACCESS_PLATFORM is not negotiated. This is a rare deployment the attacker cannot create. The attacker also cannot choose which foreign machine frames the pseudo-physical pfns resolve to.\nPR:L - VIRTGPU_RESOURCE_CREATE, TRANSFER_TO_HOST and TRANSFER_FROM_HOST are all marked DRM_RENDER_ALLOW. Any user with access to /dev/dri/renderD* (render group or a logind seat ACL) can reach them without root.\nUI:N - The attacker creates the resource and issues the transfer ioctls entirely on their own. No other user has to act.\nS:C - virtio_gpu_object_shmem_init() hands the host guest-pseudo-physical addresses, which the host resolves to machine frames owned by other Xen domains or by Xen itself. So a flaw in the dom0 driver affects memory outside that domain\u0027s security authority.\nC:H - virtio_gpu_cmd_transfer_to_host_2d/3d make the host copy unrelated machine pages (other domains\u0027 memory) into a host resource, which is then scanned out. With virgl, the attacker could plausibly copy that resource into memory they can read back.\nI:H - With virgl, VIRTGPU_TRANSFER_FROM_HOST makes the host write resource data to the wrong backing addresses. Those addresses are machine frames belonging to other domains or the hypervisor, so this is an uncontrolled cross-domain memory write.\nA:H - Host writes into foreign machine frames through the bad backing entries can corrupt Xen or other domains\u0027 memory, crashing them. The unsynced swiotlb path (missing dma_sync_sgtable_for_device) also corrupts display data."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:42:14.960Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/93c557e947ef0040004b1ac6a1c1265d79a957e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/455184dbe9652d01470d3c5cf5edd09a7a673a99"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a736d2f9d0c6e6217fe7532bc4c50ceca71db78"
        }
      ],
      "title": "drm/virtio: use the DMA API for resource backing on Xen",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98156",
    "datePublished": "2026-09-25T10:36:26.409Z",
    "dateReserved": "2026-09-25T10:25:14.320Z",
    "dateUpdated": "2026-09-25T14:42:14.960Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/virtio/virtgpu_drv.h",
                  "drivers/gpu/drm/virtio/virtgpu_object.c",
                  "drivers/gpu/drm/virtio/virtgpu_vq.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "93c557e947ef0040004b1ac6a1c1265d79a957e1",
                    "status": "affected",
                    "version": "a3b815f09bb846255c458c181b8a5b1cc66891b4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "455184dbe9652d01470d3c5cf5edd09a7a673a99",
                    "status": "affected",
                    "version": "a3b815f09bb846255c458c181b8a5b1cc66891b4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6a736d2f9d0c6e6217fe7532bc4c50ceca71db78",
                    "status": "affected",
                    "version": "a3b815f09bb846255c458c181b8a5b1cc66891b4",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/virtio/virtgpu_drv.h",
                  "drivers/gpu/drm/virtio/virtgpu_object.c",
                  "drivers/gpu/drm/virtio/virtgpu_vq.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.20"
                  },
                  {
                    "lessThan": "4.20",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: use the DMA API for resource backing on Xen\n\nOn a Xen PV domain page addresses bear no relation to the real machine\naddresses the host would have to use to reach it.\nvirtio_ring.c handles this correctly, vring_use_map_api() returns true\nfor any xen_domain() regardless of VIRTIO_F_ACCESS_PLATFORM.\n\nvirtio-gpu makes the same decision independently, but its copy\nlooks only at the feature bit:\n\n\tbool use_dma_api = !virtio_has_dma_quirk(vgdev-\u003evdev);\n\nQEMU does not set iommu_platform on virtio-vga by default, so\nVIRTIO_F_ACCESS_PLATFORM is not negotiated, use_dma_api is false, and\nvirtio_gpu_object_shmem_init() describes the framebuffer\u0027s backing pages\nto the host with sg_phys().  Those are guest-physical addresses. In a PV\ndomain they resolve, on the host side, to pages belonging to some other\ndomain, so the host scans out unrelated memory.\n\nMove the decision into virtio_gpu_use_dma_api() and give it the\nxen_domain() check, like vring_use_map_api() has. This\nadditionally enables the dma_sync_sgtable_for_device() calls in\nvirtgpu_vq.c, which are required for correctness whenever swiotlb\nis in play.\n\nReproduced with a Xen 4.21 PV dom0 nested inside QEMU 8.2 with\nvirtio-vga, on both a distro 6.8 kernel and 6.18 LTS. A PVH dom0\nworks fine and doesn\u0027t need this fix because it is identity-mapped,\nonly PV dom0s are affected."
          }
        ],
        "id": "CVE-2026-98156",
        "lastModified": "2026-09-25T15:18:07.240",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.1,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-25T11:17:47.280",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/455184dbe9652d01470d3c5cf5edd09a7a673a99"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6a736d2f9d0c6e6217fe7532bc4c50ceca71db78"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/93c557e947ef0040004b1ac6a1c1265d79a957e1"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.