CVE-2026-98156

Status: UPDATED  |  Advisory ID: CVE-2026-98156

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: use the DMA API for resource backing on Xen

On a Xen PV domain page addresses bear no relation to the real machine

addresses the host would have to use to reach it.

virtio_ring.c handles this correctly, vring_use_map_api() returns true

for any xen_domain() regardless of VIRTIO_F_ACCESS_PLATFORM.

virtio-gpu makes the same decision independently, but its copy

looks only at the feature bit:

bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev);

QEMU does not set iommu_platform on virtio-vga by default, so

VIRTIO_F_ACCESS_PLATFORM is not negotiated, use_dma_api is false, and

virtio_gpu_object_shmem_init() describes the framebuffer's backing pages

to the host with sg_phys(). Those are guest-physical addresses. In a PV

domain they resolve, on the host side, to pages belonging to some other

domain, so the host scans out unrelated memory.

Move the decision into virtio_gpu_use_dma_api() and give it the

xen_domain() check, like vring_use_map_api() has. This

additionally enables the dma_sync_sgtable_for_device() calls in

virtgpu_vq.c, which are required for correctness whenever swiotlb

is in play.

Reproduced with a Xen 4.21 PV dom0 nested inside QEMU 8.2 with

virtio-vga, on both a distro 6.8 kernel and 6.18 LTS. A PVH dom0

works fine and doesn't need this fix because it is identity-mapped,

only PV dom0s are affected. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References