Is there a patch available for CVE-2026-98606?

Yes, a patch is available for CVE-2026-98606. Update the affected software to the latest version immediately.

Linux CVE-2026-98606

EUVD-2026-103651

2026-10-18 Linux

GHSA-9vq3-mxmp-fq54

Information Disclosure Linux

View

Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: release the GEM object on virtio_gpu_vram_create() errors

virtio_gpu_vram_create() frees the object with a bare kfree(vram) on both error paths after drm_gem_private_object_init() has run, and on the second one after drm_gem_create_mmap_offset() has linked obj->vma_node into the device's VMA offset manager. The freed object stays in that interval tree, so a later lookup or insertion walks freed memory, and the dma_resv and gpuva lock are never destroyed.

Call drm_gem_object_release() before kfree() on both paths.

Affected VersionsENISA

Linux patch: 5.15.222

Linux patch: 0

Linux 5.11

Linux 16845c5d540929d2f4dc845f11fbbb238e69170a <036d28db1818af2f9d80db771f5405da84d7732d

Linux 16845c5d540929d2f4dc845f11fbbb238e69170a <03bdbf182082694ab2add620d85f1a8b8f51bbbc

Linux patch: 7.2.9

Linux 16845c5d540929d2f4dc845f11fbbb238e69170a <5118b5fdf1eb9922a0cdd2afd25252081e2d4302

Linux patch: 7.3-rc5

Linux 16845c5d540929d2f4dc845f11fbbb238e69170a <7c8deb77d05bcc8f79e255f669d82ec6ce91be12

Linux patch: 6.1.189

Linux patch: 6.6.158

Linux 16845c5d540929d2f4dc845f11fbbb238e69170a <5c2cb3dd1447752b73d4f44d6b7434bc5259bfec

Linux patch: 6.12.112

Linux 16845c5d540929d2f4dc845f11fbbb238e69170a <a9bb8f8fd5694185c2f71ff91869afb300aab392

Linux patch: 6.18.55

Linux 16845c5d540929d2f4dc845f11fbbb238e69170a <977c2934064969503cabf98b1135d202ff62822e

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Oct 18, 2026 - 16:02 EUVD

CVE Published

Oct 18, 2026 - 15:19 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 90% exploitable

Data Quality

3 sources

Confidence: Low

EUVD

CVE.org

EPSS MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.