{"id":"CVE-2026-98156","revision":"9c007370f6c243f2a5a6384bcd77b4a0","records":[{"revision":"9c007370f6c243f2a5a6384bcd77b4a0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98156","aliases":[],"title":"drm/virtio: use the DMA API for resource backing on Xen","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: use the DMA API for resource backing on Xen\n\nOn a Xen PV domain page addresses bear no relation to the real machine\naddresses the host would have to use to reach it.\nvirtio_ring.c handles this correctly, vring_use_map_api() returns true\nfor any xen_domain() regardless of VIRTIO_F_ACCESS_PLATFORM.\n\nvirtio-gpu makes the same decision independently, but its copy\nlooks only at the feature bit:\n\n\tbool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev);\n\nQEMU does not set iommu_platform on virtio-vga by default, so\nVIRTIO_F_ACCESS_PLATFORM is not negotiated, use_dma_api is false, and\nvirtio_gpu_object_shmem_init() describes the framebuffer's backing pages\nto the host with sg_phys().  Those are guest-physical addresses. In a PV\ndomain they resolve, on the host side, to pages belonging to some other\ndomain, so the host scans out unrelated memory.\n\nMove the decision into virtio_gpu_use_dma_api() and give it the\nxen_domain() check, like vring_use_map_api() has. This\nadditionally enables the dma_sync_sgtable_for_device() calls in\nvirtgpu_vq.c, which are required for correctness whenever swiotlb\nis in play.\n\nReproduced with a Xen 4.21 PV dom0 nested inside QEMU 8.2 with\nvirtio-vga, on both a distro 6.8 kernel and 6.18 LTS. A PVH dom0\nworks fine and doesn't need this fix because it is identity-mapped,\nonly PV dom0s are affected.","state":0,"publishedAt":"2026-09-25T10:36:26.409+00:00","modifiedAt":"2026-10-21T12:54:43.922+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/virtio/virtgpu_drv.h\",\n                        \"drivers/gpu/drm/virtio/virtgpu_object.c\",\n                        \"drivers/gpu/drm/virtio/virtgpu_vq.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"a3b815f09bb846255c458c181b8a5b1cc66891b4\",\n                            \"lessThan\": \"32e999ccf5f6453b3b4df8264ff1b03c6720292f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a3b815f09bb846255c458c181b8a5b1cc66891b4\",\n                            \"lessThan\": \"3f130cc6826fabf50e01fe8e4ff3ed1fcae50d36\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a3b815f09bb846255c458c181b8a5b1cc66891b4\",\n                            \"lessThan\": \"93c557e947ef0040004b1ac6a1c1265d79a957e1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a3b815f09bb846255c458c181b8a5b1cc66891b4\",\n                            \"lessThan\": \"455184dbe9652d01470d3c5cf5edd09a7a673a99\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a3b815f09bb846255c458c181b8a5b1cc66891b4\",\n                            \"lessThan\": \"6a736d2f9d0c6e6217fe7532bc4c50ceca71db78\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/virtio/virtgpu_drv.h\",\n                        \"drivers/gpu/drm/virtio/virtgpu_object.c\",\n                        \"drivers/gpu/drm/virtio/virtgpu_vq.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.20\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.20\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.160\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.114\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.53\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.7\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/32e999ccf5f6453b3b4df8264ff1b03c6720292f","https://git.kernel.org/stable/c/3f130cc6826fabf50e01fe8e4ff3ed1fcae50d36","https://git.kernel.org/stable/c/93c557e947ef0040004b1ac6a1c1265d79a957e1","https://git.kernel.org/stable/c/455184dbe9652d01470d3c5cf5edd09a7a673a99","https://git.kernel.org/stable/c/6a736d2f9d0c6e6217fe7532bc4c50ceca71db78"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98156","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98156","identifiers":["CVE-2026-98156"]},"retained":false,"historicalAffected":[]}],"coverage":[]}