Linux Kernel CVE-2026-66020

Requires local access inside a virtual machine guest whose configuration exposes a virtio-gpu device, plus permission to open the DRM/render node and allocate blob-backed scanout resources; the flaw is reached via the resource-mapping cleanup path. Limiting factors: the vulnerable code only runs in guests that actually have a virtio-gpu device (typical of QEMU/KVM and cloud desktop/graphics guests, not all VMs), the attacker must already be local within the guest, and triggering a use-after-free on cleanup likely depends on specific ordering/timing - there is no remote or unauthenticated path implied by the available data.

Critical signal gaps dominate this assessment: no CVSS score/vector, no CWE, no EPSS probability, no SSVC decision, no KEV listing, and no POC indicator were provided - the only confirmed sourcing is a vendor:ubuntu report. Based solely on the patch title 'virtio-gpu: disable blob scanouts on mapping cleanup', this is a Linux kernel memory-safety flaw in the virtio-gpu guest graphics driver: blob scanouts are not torn down when their backing mapping is cleaned up, a classic use-after-free / dangling-reference pattern. Such flaws are inherently local (an attacker must already have code execution inside a guest and access to the virtio-gpu DRM device), which caps real-world risk well below a remote-unauthenticated issue despite the potential for kernel memory corruption. There is no evidence of active exploitation and no public exploit identified at time of analysis; absent EPSS/KEV data, mass exploitation cannot be inferred. Treat this as a standard kernel hardening/local-privesc-or-DoS fix to roll out via normal patch cadence rather than an emergency - but note the severity ceiling (kernel UAF can enable privilege escalation) means it should not be deprioritized indefinitely. All impact claims here are INFERRED from the patch title, not confirmed by a vendor advisory or NVD vector.

A local, low-privileged user (or compromised process) inside a VM guest that exposes a virtio-gpu device opens the DRM render node, creates a blob resource used as a scanout, then triggers the resource/mapping cleanup path so the driver continues referencing a scanout whose backing mapping has been freed. The resulting use-after-free can corrupt guest kernel memory, yielding a denial of service (guest crash) and potentially local privilege escalation. No public exploit code was identified in the provided data, and exploitation requires local guest access to the virtio-gpu device.