CyberSecBulletin
CVE-2026-64098NVD status: Modified

Linux: Improper Locking

Published Updated By the CyberSecBulletin desk

CVE-2026-64098 is a high-severity improper locking vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions c86077d512ee980cc91322211d35dbcd3175f64c, 21ab64c77a30d56efc506c8fa2ad8959f8ce3d36, 7930eee22cd3df61e85be8aa512032ab303b7167 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.11% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to c86077d512ee980cc91322211d35dbcd3175f64c or 21ab64c77a30d56efc506c8fa2ad8959f8ce3d36 or 7930eee22cd3df61e85be8aa512032ab303b7167 or 8fadd01cf461fee5bb11506621339c548447e5c7, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 6.1.175 or 6.6.142 or 6.12.92 or 6.18.34, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux5cfd31c5b3a321aed0c9621b7b45efa2942056f8 up to, but not including, c86077d512ee980cc91322211d35dbcd3175f64c; 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 up to, but not including, 21ab64c77a30d56efc506c8fa2ad8959f8ce3d36; 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 up to, but not including, 7930eee22cd3df61e85be8aa512032ab303b7167; 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 up to, but not including, 8fadd01cf461fee5bb11506621339c548447e5c7; 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 up to, but not including, a2359a411b15f495d12cfda6a7db6855ebb7f90f; 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 up to, but not including, 9af1b6e175c82daf4b423da339a722d8e67a735a; 5.7c86077d512ee980cc91322211d35dbcd3175f64c, 21ab64c77a30d56efc506c8fa2ad8959f8ce3d36, 7930eee22cd3df61e85be8aa512032ab303b7167, 8fadd01cf461fee5bb11506621339c548447e5c7, a2359a411b15f495d12cfda6a7db6855ebb7f90f, 9af1b6e175c82daf4b423da339a722d8e67a735a
LinuxLinux Kernel5.7 up to, but not including, 6.1.175; 6.2 up to, but not including, 6.6.142; 6.7 up to, but not including, 6.12.92; 6.13 up to, but not including, 6.18.34; 6.19 up to, but not including, 7.0.11; 7.16.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use uninterruptible resv lock for plane updates virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() lock the framebuffer BO's dma_resv via virtio_gpu_array_lock_resv() and ignore its return value. The function can fail with -EINTR from dma_resv_lock_interruptible() (signal during lock wait) or with -ENOMEM from dma_resv_reserve_fences() (fence slot allocation), leaving the resv lock not held. The queue path then walks the object array and calls dma_resv_add_fence(), which requires the lock held; with lockdep enabled this trips dma_resv_assert_held(): WARNING: drivers/dma-buf/dma-resv.c:296 at dma_resv_add_fence+0x71e/0x840 Call Trace: virtio_gpu_array_add_fence virtio_gpu_queue_ctrl_sgs virtio_gpu_queue_fenced_ctrl_buffer virtio_gpu_cursor_plane_update drm_atomic_helper_commit_planes drm_atomic_helper_commit_tail commit_tail drm_atomic_helper_commit drm_atomic_commit drm_atomic_helper_update_plane __setplane_atomic drm_mode_cursor_universal drm_mode_cursor_common drm_mode_cursor_ioctl drm_ioctl __x64_sys_ioctl Beyond the WARN, mutating the dma_resv fence list without the lock races with concurrent readers/writers and can corrupt the list. Both call sites run inside the .atomic_update plane callback, which DRM atomic helpers do not allow to fail (by the time it runs, the commit has been signed off to userspace and there is no clean rollback path). Moving the lock acquisition to .prepare_fb was rejected because the broader lock scope deadlocks against other BO locking paths in the same atomic commit. Introduce virtio_gpu_lock_one_resv_uninterruptible() that uses dma_resv_lock() instead of dma_resv_lock_interruptible(). This eliminates the -EINTR failure mode -- the realistic syzbot trigger -- without extending the lock hold across the commit. The helper locks a single BO and rejects nents > 1 with -EINVAL; both fix sites lock exactly one BO. Use it from virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush(); check the return value to handle the remaining -ENOMEM case from dma_resv_reserve_fences() by freeing the objs and skipping the plane update for that frame. The framebuffer BOs touched here are not shared with other contexts and lock contention is expected to be brief, so the loss of signal-interruptibility is acceptable. Other callers of virtio_gpu_array_lock_resv() (the ioctl paths) continue to use the interruptible variant. The bug was reported by syzbot, triggered via fault injection (fail_nth) on the DRM_IOCTL_MODE_CURSOR path, which forces the -ENOMEM branch in dma_resv_reserve_fences().

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Locking

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

How developers prevent this class of flaw

  • Use industry standard APIs to implement locking mechanism.

More Improper Locking vulnerabilities (CWE-667)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Locking vulnerabilities

Spotted an error? Tell us.