CVE-2026-98404 in Linux
Summary
by MITRE • 10/15/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
Smatch complains that returning a NULL here will lead to a NULL pointer dereference in drm_mode_addfb2(). Return an error pointer instead.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified within the Linux kernel's DRM subsystem specifically affects the virtio GPU driver, manifesting as a critical logic error during framebuffer creation operations. The core issue resides in the function virtio_gpu_user_framebuffer_create(), which is responsible for initializing user-space framebuffers for virtualized graphics contexts. Under certain failure conditions or when resource allocation fails, this function incorrectly returns NULL instead of an appropriate error pointer. This deviation from standard kernel programming practices creates a dangerous state where downstream functions expect either a valid object reference or a specific encoded error value, rather than a null indicator.
The operational impact arises in the subsequent call to drm_mode_addfb2(), which processes the framebuffer descriptor provided by user space. This function is not designed to handle NULL pointers as input for its primary data structures; it assumes that if an operation fails at this stage, the caller has returned an ERR_PTR-encoded negative error code. When a NULL pointer is passed instead, the kernel attempts to dereference memory address zero or an invalid low-address region during internal validation and setup routines. This results in a null pointer dereference exception, which typically triggers a kernel panic on most architectures due to the protection of the lowest page table entries. Consequently, this flaw allows for a local denial-of-service attack where any unprivileged user with access to DRM devices can crash the entire system by triggering the specific code path that leads to the erroneous return value.
From a vulnerability classification perspective, this issue aligns closely with CWE-476, which denotes a NULL Pointer Dereference. The root cause is categorized under CWE-390, indicating that the software attempts to use an error indicator other than an error code when it should not have been used. In terms of adversarial tactics, this vulnerability supports techniques associated with ATT&CK ID T1499, specifically Endpoint Denial of Service via resource exhaustion or crash induction through invalid input handling. The flaw represents a failure in defensive programming practices where the function did not adhere to the kernel's convention for returning errors from pointer-returning functions.
To mitigate this vulnerability and prevent similar issues in related subsystems, developers must ensure that all functions returning pointers also return ERR_PTR-encoded values upon failure rather than NULL. This involves using macros such as PTR_ERR or IS_ERR consistently throughout the call chain to validate inputs before dereferencing them. For system administrators running affected kernel versions, applying the latest security patches provided by their distribution is essential. These updates include the corrected logic in virtio_gpu_user_framebuffer_create() that properly returns an error pointer when framebuffer creation fails, thereby preventing the null pointer dereference and maintaining system stability during virtualized graphics operations.