DMA API Vulnerability in Linux Kernel Affects Virtio-GPU for Xen PV Domains

CVE-2026-98156

What is CVE-2026-98156?

A vulnerability has been identified in the Linux kernel pertaining to the virtio-gpu in Xen PV domains. The issue arises when the DMA API is not appropriately utilized for resource backing, allowing the host to access incorrect memory pages from unrelated domains. This flawed behavior in virtio-gpu, combined with improper handling of guest-physical addresses, could lead to unauthorized memory disclosure. The vulnerability requires addressing in systems running Xen PV environments with specific kernel versions, emphasizing the need for security patches and updates.

References