CVE-2026-98404 drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()

Not scored Published 14 Oct 2026 Updated 19 Oct 2026

A local attacker can trigger a NULL pointer dereference in the virtio GPU driver, causing a system crash.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-98404?

CVE-2026-98404 is a vulnerability in Linux, published on 14 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()

Smatch complains that returning a NULL here will lead to a NULL pointer dereference in drm_mode_addfb2(). Return an error pointer instead.

Which versions are affected by CVE-2026-98404?

How do I fix CVE-2026-98404?

Apply the vendor's patch.

Is CVE-2026-98404 being exploited?

There is no known exploitation of CVE-2026-98404 in the wild and no public exploit code.

Sources

Also known as AZL-108159, BELL-CVE-2026-98404, DEBIAN-CVE-2026-98404, GHSA-rmwq-mp73-r282, UBUNTU-CVE-2026-98404.