Linux drm/virtio: virtio-gpu hands guest-physical addresses to the host on Xen PV, exposing another domain's memory

Impact

virtio-gpu decided whether to use the DMA API from the VIRTIO_F_ACCESS_PLATFORM feature bit alone, ignoring the Xen case that virtio_ring already handles. In a Xen PV domain, guest-physical addresses bear no relation to machine addresses, so the framebuffer backing pages described to the host resolve to pages belonging to some other domain and the host scans out unrelated memory. That is a cross-domain memory disclosure through the display path, plus corruption risk, and it also restores the dma_sync calls needed for correctness when swiotlb is in play. The practical exposure for a GPU fleet is narrow: it needs Xen PV (not PVH, which is identity-mapped) with virtio-vga, a configuration most accelerator hosts do not run. Where it does apply, no attacker action is required for the leak - it is a property of the configuration.

Who can reach it

No remote or authenticated attack step: a Xen PV domain running the virtio-gpu driver against a host that did not negotiate VIRTIO_F_ACCESS_PLATFORM (QEMU's virtio-vga default) causes the host to read pages of other domains. A local user in the guest able to drive the display path widens what gets referenced. PVH and HVM domains are not affected.

What to do

Take the stable kernel update containing the fix (three stable commits are linked; pick the one for your series) and reboot each affected host or guest - a kernel change on the DRM path cannot be hot-patched. If you cannot reboot soon, the configuration-level mitigation is to stop using Xen PV domains with virtio-vga: PVH dom0 is unaffected, and enabling iommu_platform on the virtio-vga device makes virtio-gpu take the DMA API path on its own.

References

Related entries

• accel/amdxdna: device buffers could be exported over dma-buf when they were never meant to beCVE-2026-98436 · Linux kernel accel/amdxdna (AMD XDNA NPU device buffer dma-buf export)High
• Linux kernel drm/xe: NULL pointer dereference racing VM close against eviction of a shared BOCVE-2026-98510 · Linux kernel drm/xe (VM close path, contested VMA vs page-table teardown)High
• Linux kernel nouveau: double-free of VMM page array when client init fails on device openCVE-2026-98515 · Linux kernel nouveau (nvif_vmm_dtor client teardown)High
• Linux kernel nouveau/uvmm: use-after-free reading resource type when BO sits in TTM_PL_SYSTEMCVE-2026-98517 · Linux kernel nouveau uvmm (GPU VA bind path, TTM_PL_SYSTEM resource)High
• Linux kernel amdkfd: cached address_space for /dev/kfd causes use-after-free and missed unmap on GPU resetCVE-2026-98520 · Linux kernel amdgpu/amdkfd (kfd_dev_mapping cached address_space)High
• Linux kernel drm/xe: final framebuffer unpin leaves a stale pinned-list entry and risks use-after-freeCVE-2026-98999 · Linux kernel drm/xe (pinned_link bookkeeping on framebuffer unpin)High