CVE-2026-98156

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use the DMA API for resource backing on Xen On a Xen PV domain page addresses bear no relation to the real machine addresses the host would have to use to reach it. virtio_ring.c handles this correctly, vring_use_map_api() returns true for any xen_domain() regardless of VIRTIO_F_ACCESS_PLATFORM. virtio-gpu makes the same decision independently, but its copy looks only at the feature bit: bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev); QEMU does not set iommu_platform on virtio-vga by default, so VIRTIO_F_ACCESS_PLATFORM is not negotiated, use_dma_api is false, and virtio_gpu_object_shmem_init() describes the framebuffer's backing pages to the host with sg_phys(). Those are guest-physical addresses. In a PV domain they resolve, on the host side, to pages belonging to some other domain, so the host scans out unrelated memory. Move the decision into virtio_gpu_use_dma_api() and give it the xen_domain() check, like vring_use_map_api() has. This additionally enables the dma_sync_sgtable_for_device() calls in virtgpu_vq.c, which are required for correctness whenever swiotlb is in play. Reproduced with a Xen 4.21 PV dom0 nested inside QEMU 8.2 with virtio-vga, on both a distro 6.8 kernel and 6.18 LTS. A PVH dom0 works fine and doesn't need this fix because it is identity-mapped, only PV dom0s are affected.

• https://git.kernel.org/stable/c/32e999ccf5f6453b3b4df8264ff1b03c6720292f
• https://git.kernel.org/stable/c/3f130cc6826fabf50e01fe8e4ff3ed1fcae50d36
• https://git.kernel.org/stable/c/455184dbe9652d01470d3c5cf5edd09a7a673a99Patch
• https://git.kernel.org/stable/c/6a736d2f9d0c6e6217fe7532bc4c50ceca71db78Patch
• https://git.kernel.org/stable/c/93c557e947ef0040004b1ac6a1c1265d79a957e1Patch

Published

Sep 25, 2026

Last Modified

Oct 21, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-98150In the Linux kernel, the following vulnerability has been re…7
• CVE-2026-98151In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-98152In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-98153In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-98154In the Linux kernel, the following vulnerability has been re…7
• CVE-2026-98155In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-98157In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-98158In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-98159In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-9816Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 1…8.3
• CVE-2026-98160In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-98161In the Linux kernel, the following vulnerability has been re…5.5