CVE-2026-98404

drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()

Published Oct 14, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()

Smatch complains that returning a NULL here will lead to a NULL pointer
dereference in drm_mode_addfb2(). Return an error pointer instead.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`dc5698e80cf724770283e10414054662bdf6ccfa`	affected	< 975f3cf302bb7d7336df4c630a7c07e12780ad10
`dc5698e80cf724770283e10414054662bdf6ccfa`	affected	< 07de0b31dd64094cd7d25729beaf2ecae74daa72
`dc5698e80cf724770283e10414054662bdf6ccfa`	affected	< 5eda6cda0031ba17559d56882353be39e568ec09
`dc5698e80cf724770283e10414054662bdf6ccfa`	affected	< 3fe8a33715265ecb24ca0bcd0a575c926da4277c
`dc5698e80cf724770283e10414054662bdf6ccfa`	affected	< 974845d2535a250b180e62f9ed50284f312c01a3
`dc5698e80cf724770283e10414054662bdf6ccfa`	affected	< 45dc2788a5b0e1e2824d1f98af521bd3acc340d7
`dc5698e80cf724770283e10414054662bdf6ccfa`	affected	< f1050a7d365283678b253828739d3866ae546a72
`dc5698e80cf724770283e10414054662bdf6ccfa`	affected	< 94579f24e2b526a04eb41050af0ba018c6f528e7

Linux

affected

Version	Status	Constraints
`4.2`	affected	—
`0`	unaffected	< 4.2
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2.7`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[dc5698e80cf724770283e10414054662bdf6ccfa,975f3cf302bb7d7336df4c630a7c07e12780ad10)`	affected	code_commit	—
`[dc5698e80cf724770283e10414054662bdf6ccfa,07de0b31dd64094cd7d25729beaf2ecae74daa72)`	affected	code_commit	—
`[dc5698e80cf724770283e10414054662bdf6ccfa,3fe8a33715265ecb24ca0bcd0a575c926da4277c)`	affected	code_commit	—
`[dc5698e80cf724770283e10414054662bdf6ccfa,5eda6cda0031ba17559d56882353be39e568ec09)`	affected	code_commit	—
`[dc5698e80cf724770283e10414054662bdf6ccfa,974845d2535a250b180e62f9ed50284f312c01a3)`	affected	code_commit	—
`[dc5698e80cf724770283e10414054662bdf6ccfa,45dc2788a5b0e1e2824d1f98af521bd3acc340d7)`	affected	code_commit	—
`[dc5698e80cf724770283e10414054662bdf6ccfa,f1050a7d365283678b253828739d3866ae546a72)`	affected	code_commit	—
`[dc5698e80cf724770283e10414054662bdf6ccfa,94579f24e2b526a04eb41050af0ba018c6f528e7)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.2`	affected	generic	—
`[0,4.2)`	unaffected	generic	—
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2.7,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4841-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.216% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98404.mbox
https://git.kernel.org/stable/c/07de0b31dd64094cd7d25729beaf2ecae74daa72
https://git.kernel.org/stable/c/3fe8a33715265ecb24ca0bcd0a575c926da4277c
https://git.kernel.org/stable/c/45dc2788a5b0e1e2824d1f98af521bd3acc340d7
https://git.kernel.org/stable/c/5eda6cda0031ba17559d56882353be39e568ec09
https://git.kernel.org/stable/c/94579f24e2b526a04eb41050af0ba018c6f528e7
https://git.kernel.org/stable/c/974845d2535a250b180e62f9ed50284f312c01a3
https://git.kernel.org/stable/c/975f3cf302bb7d7336df4c630a7c07e12780ad10
https://git.kernel.org/stable/c/f1050a7d365283678b253828739d3866ae546a72
https://nvd.nist.gov/vuln/detail/CVE-2026-98404
https://www.cve.org/CVERecord?id=CVE-2026-98404

History

Oct 15, 2026 11:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-690

Oct 15, 2026 1:30 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98404.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98404 https://www.cve.org/CVERecord?id=CVE-2026-98404
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Oct 15, 2026 4:00 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-690

Oct 14, 2026 1:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() Smatch complains that returning a NULL here will lead to a NULL pointer dereference in drm_mode_addfb2(). Return an error pointer instead.
Title		drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/07de0b31dd64094cd7d25729beaf2ecae74daa72 https://git.kernel.org/stable/c/3fe8a33715265ecb24ca0bcd0a575c926da4277c https://git.kernel.org/stable/c/45dc2788a5b0e1e2824d1f98af521bd3acc340d7 https://git.kernel.org/stable/c/5eda6cda0031ba17559d56882353be39e568ec09 https://git.kernel.org/stable/c/94579f24e2b526a04eb41050af0ba018c6f528e7 https://git.kernel.org/stable/c/974845d2535a250b180e62f9ed50284f312c01a3 https://git.kernel.org/stable/c/975f3cf302bb7d7336df4c630a7c07e12780ad10 https://git.kernel.org/stable/c/f1050a7d365283678b253828739d3866ae546a72