CVE-2026-64098 (GCVE-0-2026-64098)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:40 – Updated: 2026-08-05 12:39
VLAI
Title
drm/virtio: use uninterruptible resv lock for plane updates
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use uninterruptible resv lock for plane updates virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() lock the framebuffer BO's dma_resv via virtio_gpu_array_lock_resv() and ignore its return value. The function can fail with -EINTR from dma_resv_lock_interruptible() (signal during lock wait) or with -ENOMEM from dma_resv_reserve_fences() (fence slot allocation), leaving the resv lock not held. The queue path then walks the object array and calls dma_resv_add_fence(), which requires the lock held; with lockdep enabled this trips dma_resv_assert_held(): WARNING: drivers/dma-buf/dma-resv.c:296 at dma_resv_add_fence+0x71e/0x840 Call Trace: virtio_gpu_array_add_fence virtio_gpu_queue_ctrl_sgs virtio_gpu_queue_fenced_ctrl_buffer virtio_gpu_cursor_plane_update drm_atomic_helper_commit_planes drm_atomic_helper_commit_tail commit_tail drm_atomic_helper_commit drm_atomic_commit drm_atomic_helper_update_plane __setplane_atomic drm_mode_cursor_universal drm_mode_cursor_common drm_mode_cursor_ioctl drm_ioctl __x64_sys_ioctl Beyond the WARN, mutating the dma_resv fence list without the lock races with concurrent readers/writers and can corrupt the list. Both call sites run inside the .atomic_update plane callback, which DRM atomic helpers do not allow to fail (by the time it runs, the commit has been signed off to userspace and there is no clean rollback path). Moving the lock acquisition to .prepare_fb was rejected because the broader lock scope deadlocks against other BO locking paths in the same atomic commit. Introduce virtio_gpu_lock_one_resv_uninterruptible() that uses dma_resv_lock() instead of dma_resv_lock_interruptible(). This eliminates the -EINTR failure mode -- the realistic syzbot trigger -- without extending the lock hold across the commit. The helper locks a single BO and rejects nents > 1 with -EINVAL; both fix sites lock exactly one BO. Use it from virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush(); check the return value to handle the remaining -ENOMEM case from dma_resv_reserve_fences() by freeing the objs and skipping the plane update for that frame. The framebuffer BOs touched here are not shared with other contexts and lock contention is expected to be brief, so the loss of signal-interruptibility is acceptable. Other callers of virtio_gpu_array_lock_resv() (the ioctl paths) continue to use the interruptible variant. The bug was reported by syzbot, triggered via fault injection (fail_nth) on the DRM_IOCTL_MODE_CURSOR path, which forces the -ENOMEM branch in dma_resv_reserve_fences().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 , < c86077d512ee980cc91322211d35dbcd3175f64c (git)
Affected: 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 , < 21ab64c77a30d56efc506c8fa2ad8959f8ce3d36 (git)
Affected: 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 , < 7930eee22cd3df61e85be8aa512032ab303b7167 (git)
Affected: 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 , < 8fadd01cf461fee5bb11506621339c548447e5c7 (git)
Affected: 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 , < a2359a411b15f495d12cfda6a7db6855ebb7f90f (git)
Affected: 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 , < 9af1b6e175c82daf4b423da339a722d8e67a735a (git)
Create a notification for this product.
Linux Linux Affected: 5.7
Unaffected: 0 , < 5.7 (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.142 , ≤ 6.6.* (semver)
Unaffected: 6.12.92 , ≤ 6.12.* (semver)
Unaffected: 6.18.34 , ≤ 6.18.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/virtio/virtgpu_drv.h",
            "drivers/gpu/drm/virtio/virtgpu_gem.c",
            "drivers/gpu/drm/virtio/virtgpu_plane.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c86077d512ee980cc91322211d35dbcd3175f64c",
              "status": "affected",
              "version": "5cfd31c5b3a321aed0c9621b7b45efa2942056f8",
              "versionType": "git"
            },
            {
              "lessThan": "21ab64c77a30d56efc506c8fa2ad8959f8ce3d36",
              "status": "affected",
              "version": "5cfd31c5b3a321aed0c9621b7b45efa2942056f8",
              "versionType": "git"
            },
            {
              "lessThan": "7930eee22cd3df61e85be8aa512032ab303b7167",
              "status": "affected",
              "version": "5cfd31c5b3a321aed0c9621b7b45efa2942056f8",
              "versionType": "git"
            },
            {
              "lessThan": "8fadd01cf461fee5bb11506621339c548447e5c7",
              "status": "affected",
              "version": "5cfd31c5b3a321aed0c9621b7b45efa2942056f8",
              "versionType": "git"
            },
            {
              "lessThan": "a2359a411b15f495d12cfda6a7db6855ebb7f90f",
              "status": "affected",
              "version": "5cfd31c5b3a321aed0c9621b7b45efa2942056f8",
              "versionType": "git"
            },
            {
              "lessThan": "9af1b6e175c82daf4b423da339a722d8e67a735a",
              "status": "affected",
              "version": "5cfd31c5b3a321aed0c9621b7b45efa2942056f8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/virtio/virtgpu_drv.h",
            "drivers/gpu/drm/virtio/virtgpu_gem.c",
            "drivers/gpu/drm/virtio/virtgpu_plane.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: use uninterruptible resv lock for plane updates\n\nvirtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() lock\nthe framebuffer BO\u0027s dma_resv via virtio_gpu_array_lock_resv() and\nignore its return value. The function can fail with -EINTR from\ndma_resv_lock_interruptible() (signal during lock wait) or with\n-ENOMEM from dma_resv_reserve_fences() (fence slot allocation),\nleaving the resv lock not held. The queue path then walks the object\narray and calls dma_resv_add_fence(), which requires the lock held;\nwith lockdep enabled this trips dma_resv_assert_held():\n\n  WARNING: drivers/dma-buf/dma-resv.c:296 at dma_resv_add_fence+0x71e/0x840\n  Call Trace:\n   virtio_gpu_array_add_fence\n   virtio_gpu_queue_ctrl_sgs\n   virtio_gpu_queue_fenced_ctrl_buffer\n   virtio_gpu_cursor_plane_update\n   drm_atomic_helper_commit_planes\n   drm_atomic_helper_commit_tail\n   commit_tail\n   drm_atomic_helper_commit\n   drm_atomic_commit\n   drm_atomic_helper_update_plane\n   __setplane_atomic\n   drm_mode_cursor_universal\n   drm_mode_cursor_common\n   drm_mode_cursor_ioctl\n   drm_ioctl\n   __x64_sys_ioctl\n\nBeyond the WARN, mutating the dma_resv fence list without the lock\nraces with concurrent readers/writers and can corrupt the list.\n\nBoth call sites run inside the .atomic_update plane callback, which\nDRM atomic helpers do not allow to fail (by the time it runs, the\ncommit has been signed off to userspace and there is no clean\nrollback path). Moving the lock acquisition to .prepare_fb was\nrejected because the broader lock scope deadlocks against other BO\nlocking paths in the same atomic commit.\n\nIntroduce virtio_gpu_lock_one_resv_uninterruptible() that uses\ndma_resv_lock() instead of dma_resv_lock_interruptible(). This\neliminates the -EINTR failure mode -- the realistic syzbot trigger\n-- without extending the lock hold across the commit. The helper\nlocks a single BO and rejects nents \u003e 1 with -EINVAL; both fix\nsites lock exactly one BO.\n\nUse it from virtio_gpu_cursor_plane_update() and\nvirtio_gpu_resource_flush(); check the return value to handle the\nremaining -ENOMEM case from dma_resv_reserve_fences() by freeing\nthe objs and skipping the plane update for that frame. The\nframebuffer BOs touched here are not shared with other contexts\nand lock contention is expected to be brief, so the loss of\nsignal-interruptibility is acceptable.\n\nOther callers of virtio_gpu_array_lock_resv() (the ioctl paths)\ncontinue to use the interruptible variant.\n\nThe bug was reported by syzbot, triggered via fault injection\n(fail_nth) on the DRM_IOCTL_MODE_CURSOR path, which forces the\n-ENOMEM branch in dma_resv_reserve_fences()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through local DRM ioctl syscalls (DRM_IOCTL_MODE_CURSOR and DRM_MASTER modesetting ioctls) on /dev/dri/card0, not via any network-facing kernel service.\nAC:L - An attacker can reliably trigger the bug by signaling a thread blocked in dma_resv_lock_interruptible (-EINTR), forcing memory pressure for -ENOMEM, or running concurrent plane updates to race the unlocked fence-list mutation.\nPR:L - Exploitation requires DRM master on the virtio-gpu device, which a local user with standard DRI access (video/render group membership on typical virtio-gpu VMs) can obtain when no compositor holds master; this is not init-namespace root.\nUI:N - Triggering the bug requires only attacker-initiated DRM ioctl calls (cursor/plane updates); no action by another user or victim is needed.\nS:U - The corruption occurs within the same kernel security domain (guest or host) that issued the ioctl; virtio-gpu runs in the guest kernel and this does not cross a VM/hypervisor boundary to the host.\nC:H - Mutating the dma_resv fence list without holding the lock races with concurrent readers and can corrupt kernel heap metadata, which is reasonably leverageable for arbitrary memory disclosure.\nI:H - The same unlocked fence-list corruption can corrupt kernel pointers and synchronization state, providing a plausible path to arbitrary kernel writes or control-flow hijacking.\nA:H - The bug produces kernel WARN/oops under lockdep and fence-list corruption can cause kernel crashes, hangs, or panics during subsequent dma_resv operations."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:39:12.587Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c86077d512ee980cc91322211d35dbcd3175f64c"
        },
        {
          "url": "https://git.kernel.org/stable/c/21ab64c77a30d56efc506c8fa2ad8959f8ce3d36"
        },
        {
          "url": "https://git.kernel.org/stable/c/7930eee22cd3df61e85be8aa512032ab303b7167"
        },
        {
          "url": "https://git.kernel.org/stable/c/8fadd01cf461fee5bb11506621339c548447e5c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2359a411b15f495d12cfda6a7db6855ebb7f90f"
        },
        {
          "url": "https://git.kernel.org/stable/c/9af1b6e175c82daf4b423da339a722d8e67a735a"
        }
      ],
      "title": "drm/virtio: use uninterruptible resv lock for plane updates",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64098",
    "datePublished": "2026-07-19T15:40:04.264Z",
    "dateReserved": "2026-07-19T07:54:57.033Z",
    "dateUpdated": "2026-08-05T12:39:12.587Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64098",
      "date": "2026-08-10",
      "epss": "0.00146",
      "percentile": "0.04334"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64098\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:50.843\",\"lastModified\":\"2026-07-30T14:59:47.950\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/virtio: use uninterruptible resv lock for plane updates\\n\\nvirtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() lock\\nthe framebuffer BO\u0027s dma_resv via virtio_gpu_array_lock_resv() and\\nignore its return value. The function can fail with -EINTR from\\ndma_resv_lock_interruptible() (signal during lock wait) or with\\n-ENOMEM from dma_resv_reserve_fences() (fence slot allocation),\\nleaving the resv lock not held. The queue path then walks the object\\narray and calls dma_resv_add_fence(), which requires the lock held;\\nwith lockdep enabled this trips dma_resv_assert_held():\\n\\n  WARNING: drivers/dma-buf/dma-resv.c:296 at dma_resv_add_fence+0x71e/0x840\\n  Call Trace:\\n   virtio_gpu_array_add_fence\\n   virtio_gpu_queue_ctrl_sgs\\n   virtio_gpu_queue_fenced_ctrl_buffer\\n   virtio_gpu_cursor_plane_update\\n   drm_atomic_helper_commit_planes\\n   drm_atomic_helper_commit_tail\\n   commit_tail\\n   drm_atomic_helper_commit\\n   drm_atomic_commit\\n   drm_atomic_helper_update_plane\\n   __setplane_atomic\\n   drm_mode_cursor_universal\\n   drm_mode_cursor_common\\n   drm_mode_cursor_ioctl\\n   drm_ioctl\\n   __x64_sys_ioctl\\n\\nBeyond the WARN, mutating the dma_resv fence list without the lock\\nraces with concurrent readers/writers and can corrupt the list.\\n\\nBoth call sites run inside the .atomic_update plane callback, which\\nDRM atomic helpers do not allow to fail (by the time it runs, the\\ncommit has been signed off to userspace and there is no clean\\nrollback path). Moving the lock acquisition to .prepare_fb was\\nrejected because the broader lock scope deadlocks against other BO\\nlocking paths in the same atomic commit.\\n\\nIntroduce virtio_gpu_lock_one_resv_uninterruptible() that uses\\ndma_resv_lock() instead of dma_resv_lock_interruptible(). This\\neliminates the -EINTR failure mode -- the realistic syzbot trigger\\n-- without extending the lock hold across the commit. The helper\\nlocks a single BO and rejects nents \u003e 1 with -EINVAL; both fix\\nsites lock exactly one BO.\\n\\nUse it from virtio_gpu_cursor_plane_update() and\\nvirtio_gpu_resource_flush(); check the return value to handle the\\nremaining -ENOMEM case from dma_resv_reserve_fences() by freeing\\nthe objs and skipping the plane update for that frame. The\\nframebuffer BOs touched here are not shared with other contexts\\nand lock contention is expected to be brief, so the loss of\\nsignal-interruptibility is acceptable.\\n\\nOther callers of virtio_gpu_array_lock_resv() (the ioctl paths)\\ncontinue to use the interruptible variant.\\n\\nThe bug was reported by syzbot, triggered via fault injection\\n(fail_nth) on the DRM_IOCTL_MODE_CURSOR path, which forces the\\n-ENOMEM branch in dma_resv_reserve_fences().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/virtio/virtgpu_drv.h\",\"drivers/gpu/drm/virtio/virtgpu_gem.c\",\"drivers/gpu/drm/virtio/virtgpu_plane.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5cfd31c5b3a321aed0c9621b7b45efa2942056f8\",\"lessThan\":\"c86077d512ee980cc91322211d35dbcd3175f64c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5cfd31c5b3a321aed0c9621b7b45efa2942056f8\",\"lessThan\":\"21ab64c77a30d56efc506c8fa2ad8959f8ce3d36\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5cfd31c5b3a321aed0c9621b7b45efa2942056f8\",\"lessThan\":\"7930eee22cd3df61e85be8aa512032ab303b7167\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5cfd31c5b3a321aed0c9621b7b45efa2942056f8\",\"lessThan\":\"8fadd01cf461fee5bb11506621339c548447e5c7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5cfd31c5b3a321aed0c9621b7b45efa2942056f8\",\"lessThan\":\"a2359a411b15f495d12cfda6a7db6855ebb7f90f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5cfd31c5b3a321aed0c9621b7b45efa2942056f8\",\"lessThan\":\"9af1b6e175c82daf4b423da339a722d8e67a735a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/virtio/virtgpu_drv.h\",\"drivers/gpu/drm/virtio/virtgpu_gem.c\",\"drivers/gpu/drm/virtio/virtgpu_plane.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.175\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.142\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.92\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.34\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.11\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/21ab64c77a30d56efc506c8fa2ad8959f8ce3d36\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7930eee22cd3df61e85be8aa512032ab303b7167\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8fadd01cf461fee5bb11506621339c548447e5c7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9af1b6e175c82daf4b423da339a722d8e67a735a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a2359a411b15f495d12cfda6a7db6855ebb7f90f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c86077d512ee980cc91322211d35dbcd3175f64c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-20T17:08:53+00:00",
      "cve": "CVE-2026-64098",
      "id": "CVE-2026-64098",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/virtio: use uninterruptible resv lock for plane updates",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64098.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-05T00:33:33Z",
      "cve": "CVE-2026-64098",
      "id": "CVE-2026-64098",
      "initial_release_date": "2026-07-21T12:59:44Z",
      "product_status:known_affected": "118",
      "product_status:known_not_affected": "178",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64098",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64098.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.