An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - drm/virtio: use uninterruptible resv lock for plane updates virtio_gpu_cursor_plane_update() and     virtio_gpu_resource_flush() lock the framebuffer BO's dma_resv via virtio_gpu_array_lock_resv() and ignore     its return value. The function can fail with -EINTR from dma_resv_lock_interruptible() (signal during lock     wait) or with -ENOMEM from dma_resv_reserve_fences() (fence slot allocation), leaving the resv lock not     held. The queue path then walks the object array and calls dma_resv_add_fence(), which requires the lock     held; with lockdep enabled this trips dma_resv_assert_held(): WARNING: drivers/dma-buf/dma-resv.c:296 at     dma_resv_add_fence+0x71e/0x840 Call Trace: virtio_gpu_array_add_fence virtio_gpu_queue_ctrl_sgs     virtio_gpu_queue_fenced_ctrl_buffer virtio_gpu_cursor_plane_update drm_atomic_helper_commit_planes     drm_atomic_helper_commit_tail commit_tail drm_atomic_helper_commit drm_atomic_commit     drm_atomic_helper_update_plane __setplane_atomic drm_mode_cursor_universal drm_mode_cursor_common     drm_mode_cursor_ioctl drm_ioctl __x64_sys_ioctl Beyond the WARN, mutating the dma_resv fence list without     the lock races with concurrent readers/writers and can corrupt the list. Both call sites run inside the     .atomic_update plane callback, which DRM atomic helpers do not allow to fail (by the time it runs, the     commit has been signed off to userspace and there is no clean rollback path). Moving the lock acquisition     to .prepare_fb was rejected because the broader lock scope deadlocks against other BO locking paths in the     same atomic commit. Introduce virtio_gpu_lock_one_resv_uninterruptible() that uses dma_resv_lock() instead     of dma_resv_lock_interruptible(). This eliminates the -EINTR failure mode -- the realistic syzbot trigger
    -- without extending the lock hold across the commit. The helper locks a single BO and rejects nents > 1     with -EINVAL; both fix sites lock exactly one BO. Use it from virtio_gpu_cursor_plane_update() and     virtio_gpu_resource_flush(); check the return value to handle the remaining -ENOMEM case from     dma_resv_reserve_fences() by freeing the objs and skipping the plane update for that frame. The     framebuffer BOs touched here are not shared with other contexts and lock contention is expected to be     brief, so the loss of signal-interruptibility is acceptable. Other callers of virtio_gpu_array_lock_resv()     (the ioctl paths) continue to use the interruptible variant. The bug was reported by syzbot, triggered via     fault injection (fail_nth) on the DRM_IOCTL_MODE_CURSOR path, which forces the -ENOMEM branch in     dma_resv_reserve_fences(). (CVE-2026-64098)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
329326	Photon OS 5.0: Linux PHSA-2026-5.0-0926	Nessus	PhotonOS Local Security Checks	7/24/2026	7/28/2026	high
327954	Linux Distros Unpatched Vulnerability : CVE-2026-64098	Nessus	Misc.	7/20/2026	7/29/2026	high
318773	Photon OS 5.0: Linux PHSA-2026-5.0-0864	Nessus	PhotonOS Local Security Checks	6/5/2026	8/1/2026	high
322087	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1881)	Nessus	Amazon Linux Local Security Checks	6/22/2026	7/31/2026	medium
322107	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1894)	Nessus	Amazon Linux Local Security Checks	6/22/2026	7/31/2026	high
322088	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-1882)	Nessus	Amazon Linux Local Security Checks	6/22/2026	7/31/2026	high

Detections

Analytics

Plugins Search

high

high

high

medium

high

high