CVE-2026-64098— Linux kernel 安全漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 5.7版本存在安全漏洞，该漏洞源于virtio_gpu_cursor_plane_update()和virtio_gpu_resource_flush()函数锁定framebuffer BO的dma_resv时忽略返回值，可能导致锁未持有且并发读写破坏fence列表。
可能的 ATT&CK 技术 1 AI
T1068 · Exploitation for Privilege Escalation影响版本矩阵 14
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | 5cfd31c5b3a321aed0c9621b7b45efa2942056f8< c86077d512ee980cc91322211d35dbcd3175f64c |
affected |
5cfd31c5b3a321aed0c9621b7b45efa2942056f8< 21ab64c77a30d56efc506c8fa2ad8959f8ce3d36 |
affected | ||
5cfd31c5b3a321aed0c9621b7b45efa2942056f8< 7930eee22cd3df61e85be8aa512032ab303b7167 |
affected | ||
5cfd31c5b3a321aed0c9621b7b45efa2942056f8< 8fadd01cf461fee5bb11506621339c548447e5c7 |
affected | ||
5cfd31c5b3a321aed0c9621b7b45efa2942056f8< a2359a411b15f495d12cfda6a7db6855ebb7f90f |
affected | ||
5cfd31c5b3a321aed0c9621b7b45efa2942056f8< 9af1b6e175c82daf4b423da339a722d8e67a735a |
affected | ||
5.7 |
affected | ||
< 5.7 |
unaffected | ||
| … +6 条更多 | |||
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-64098 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
drm/virtio: use uninterruptible resv lock for plane updates
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: use uninterruptible resv lock for plane updates
virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() lock
the framebuffer BO's dma_resv via virtio_gpu_array_lock_resv() and
ignore its return value. The function can fail with -EINTR from
dma_resv_lock_interruptible() (signal during lock wait) or with
-ENOMEM from dma_resv_reserve_fences() (fence slot allocation),
leaving the resv lock not held. The queue path then walks the object
array and calls dma_resv_add_fence(), which requires the lock held;
with lockdep enabled this trips dma_resv_assert_held():
WARNING: drivers/dma-buf/dma-resv.c:296 at dma_resv_add_fence+0x71e/0x840
Call Trace:
virtio_gpu_array_add_fence
virtio_gpu_queue_ctrl_sgs
virtio_gpu_queue_fenced_ctrl_buffer
virtio_gpu_cursor_plane_update
drm_atomic_helper_commit_planes
drm_atomic_helper_commit_tail
commit_tail
drm_atomic_helper_commit
drm_atomic_commit
drm_atomic_helper_update_plane
__setplane_atomic
drm_mode_cursor_universal
drm_mode_cursor_common
drm_mode_cursor_ioctl
drm_ioctl
__x64_sys_ioctl
Beyond the WARN, mutating the dma_resv fence list without the lock
races with concurrent readers/writers and can corrupt the list.
Both call sites run inside the .atomic_update plane callback, which
DRM atomic helpers do not allow to fail (by the time it runs, the
commit has been signed off to userspace and there is no clean
rollback path). Moving the lock acquisition to .prepare_fb was
rejected because the broader lock scope deadlocks against other BO
locking paths in the same atomic commit.
Introduce virtio_gpu_lock_one_resv_uninterruptible() that uses
dma_resv_lock() instead of dma_resv_lock_interruptible(). This
eliminates the -EINTR failure mode -- the realistic syzbot trigger
-- without extending the lock hold across the commit. The helper
locks a single BO and rejects nents > 1 with -EINVAL; both fix
sites lock exactly one BO.
Use it from virtio_gpu_cursor_plane_update() and
virtio_gpu_resource_flush(); check the return value to handle the
remaining -ENOMEM case from dma_resv_reserve_fences() by freeing
the objs and skipping the plane update for that frame. The
framebuffer BOs touched here are not shared with other contexts
and lock contention is expected to be brief, so the loss of
signal-interruptibility is acceptable.
Other callers of virtio_gpu_array_lock_resv() (the ioctl paths)
continue to use the interruptible variant.
The bug was reported by syzbot, triggered via fault injection
(fail_nth) on the DRM_IOCTL_MODE_CURSOR path, which forces the
-ENOMEM branch in dma_resv_reserve_fences().
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 5.7版本存在安全漏洞，该漏洞源于virtio_gpu_cursor_plane_update()和virtio_gpu_resource_flush()函数锁定framebuffer BO的dma_resv时忽略返回值，可能导致锁未持有且并发读写破坏fence列表。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2026-64098 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-64098 的情报信息
请登录查看更多情报信息。
CVE-2026-64098 补丁与修复 (4)
CVE-2026-64098 其他参考 (1)
同批安全公告 · Linux · 2026-07-19 · 共 429 条
| CVE-2026-63795 | 10.0 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-64091 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-53399 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-53398 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-64047 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-64102 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-64056 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-64046 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-63984 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-63800 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-64061 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-63924 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-64089 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-64136 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-63979 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-63886 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-63887 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-64122 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-64125 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-63825 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
显示前 20 条，共 429 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2026-64098
暂无评论