CVE-2026-98404 - Vulnerability Details

- drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()

Smatch complains that returning a NULL here will lead to a NULL pointer
dereference in drm_mode_addfb2(). Return an error pointer instead.

Published: 2026-10-14

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`dc5698e80cf724770283e10414054662bdf6ccfa`	affected	< 975f3cf302bb7d7336df4c630a7c07e12780ad10
`dc5698e80cf724770283e10414054662bdf6ccfa`	affected	< 07de0b31dd64094cd7d25729beaf2ecae74daa72
`dc5698e80cf724770283e10414054662bdf6ccfa`	affected	< 5eda6cda0031ba17559d56882353be39e568ec09
`dc5698e80cf724770283e10414054662bdf6ccfa`	affected	< 3fe8a33715265ecb24ca0bcd0a575c926da4277c
`dc5698e80cf724770283e10414054662bdf6ccfa`	affected	< 974845d2535a250b180e62f9ed50284f312c01a3
`dc5698e80cf724770283e10414054662bdf6ccfa`	affected	< 45dc2788a5b0e1e2824d1f98af521bd3acc340d7
`dc5698e80cf724770283e10414054662bdf6ccfa`	affected	< f1050a7d365283678b253828739d3866ae546a72
`dc5698e80cf724770283e10414054662bdf6ccfa`	affected	< 94579f24e2b526a04eb41050af0ba018c6f528e7

Linux

affected

Version	Status	Constraints
`4.2`	affected	—
`0`	unaffected	< 4.2
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2.7`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[dc5698e80cf724770283e10414054662bdf6ccfa,975f3cf302bb7d7336df4c630a7c07e12780ad10)`	affected	code_commit	—
`[dc5698e80cf724770283e10414054662bdf6ccfa,07de0b31dd64094cd7d25729beaf2ecae74daa72)`	affected	code_commit	—
`[dc5698e80cf724770283e10414054662bdf6ccfa,3fe8a33715265ecb24ca0bcd0a575c926da4277c)`	affected	code_commit	—
`[dc5698e80cf724770283e10414054662bdf6ccfa,5eda6cda0031ba17559d56882353be39e568ec09)`	affected	code_commit	—
`[dc5698e80cf724770283e10414054662bdf6ccfa,974845d2535a250b180e62f9ed50284f312c01a3)`	affected	code_commit	—
`[dc5698e80cf724770283e10414054662bdf6ccfa,45dc2788a5b0e1e2824d1f98af521bd3acc340d7)`	affected	code_commit	—
`[dc5698e80cf724770283e10414054662bdf6ccfa,f1050a7d365283678b253828739d3866ae546a72)`	affected	code_commit	—
`[dc5698e80cf724770283e10414054662bdf6ccfa,94579f24e2b526a04eb41050af0ba018c6f528e7)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.2`	affected	generic	—
`[0,4.2)`	unaffected	generic	—
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2.7,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4841-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0022.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98404.mbox
https://git.kernel.org/stable/c/07de0b31dd64094cd7d25729beaf2ecae74daa72
https://git.kernel.org/stable/c/3fe8a33715265ecb24ca0bcd0a575c926da4277c
https://git.kernel.org/stable/c/45dc2788a5b0e1e2824d1f98af521bd3acc340d7
https://git.kernel.org/stable/c/5eda6cda0031ba17559d56882353be39e568ec09
https://git.kernel.org/stable/c/94579f24e2b526a04eb41050af0ba018c6f528e7
https://git.kernel.org/stable/c/974845d2535a250b180e62f9ed50284f312c01a3
https://git.kernel.org/stable/c/975f3cf302bb7d7336df4c630a7c07e12780ad10
https://git.kernel.org/stable/c/f1050a7d365283678b253828739d3866ae546a72
https://nvd.nist.gov/vuln/detail/CVE-2026-98404
https://www.cve.org/CVERecord?id=CVE-2026-98404

History

Thu, 15 Oct 2026 23:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-690

Thu, 15 Oct 2026 13:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98404.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98404 https://www.cve.org/CVERecord?id=CVE-2026-98404
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Thu, 15 Oct 2026 04:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-690

Wed, 14 Oct 2026 13:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() Smatch complains that returning a NULL here will lead to a NULL pointer dereference in drm_mode_addfb2(). Return an error pointer instead.
Title		drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/07de0b31dd64094cd7d25729beaf2ecae74daa72 https://git.kernel.org/stable/c/3fe8a33715265ecb24ca0bcd0a575c926da4277c https://git.kernel.org/stable/c/45dc2788a5b0e1e2824d1f98af521bd3acc340d7 https://git.kernel.org/stable/c/5eda6cda0031ba17559d56882353be39e568ec09 https://git.kernel.org/stable/c/94579f24e2b526a04eb41050af0ba018c6f528e7 https://git.kernel.org/stable/c/974845d2535a250b180e62f9ed50284f312c01a3 https://git.kernel.org/stable/c/975f3cf302bb7d7336df4c630a7c07e12780ad10 https://git.kernel.org/stable/c/f1050a7d365283678b253828739d3866ae546a72

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-14T13:26:03.510Z

Updated: 2026-10-19T09:18:57.630Z

Reserved: 2026-09-25T10:25:14.347Z

Link: CVE-2026-98404

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-14T14:17:51.483

Modified: 2026-10-19T10:18:45.360

Link: CVE-2026-98404

Redhat

Severity : Low

Publid Date: 2026-10-14T00:00:00Z

Links: CVE-2026-98404 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-19T17:15:06Z

Weaknesses

CWE-476
NULL Pointer Dereference

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object