CVE-2026-98319: drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-06 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr When an out_fence_ptr is provided but DRM_MODE_PAGE_FLIP_EVENT is not set, a drm_pending_vblank_event will be allocated. If later, there is an allocation failure or another failure at setup_out_fence(), that event will not have base.fence set and it will not be released at complete_signaling(). Release the event and set crtc_state->event to NULL just like in the DRM_MODE_PAGE_FLIP_EVENT case when there is a failure at drm_event_reserve_init(). That is, prepare_signaling() releases the event and there is nothing to be done at complete_signaling(). Use drm_event_cancel_free() as that will also undo drm_event_reserve_init() in case it has been called.

Affected products

Linux kernel: from 4.9.10 before 4.10; 4.10 — fixed in 4.10, 7.3

How to fix

Upgrade to a fixed version: Linux kernel 4.10, 7.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-98319 or the next vulnerability affects your stack