CVE-2026-98156

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: use the DMA API for resource backing on Xen

On a Xen PV domain page addresses bear no relation to the real machine

addresses the host would have to use to reach it.

virtio_ring.c handles this correctly, vring_use_map_api() returns true

for any xen_domain() regardless of VIRTIO_F_ACCESS_PLATFORM.

virtio-gpu makes the same decision independently, but its copy

looks only at the feature bit:

bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev);

QEMU does not set iommu_platform on virtio-vga by default, so

VIRTIO_F_ACCESS_PLATFORM is not negotiated, use_dma_api is false, and

virtio_gpu_object_shmem_init() describes the framebuffer's backing pages

to the host with sg_phys(). Those are guest-physical addresses. In a PV

domain they resolve, on the host side, to pages belonging to some other

domain, so the host scans out unrelated memory.

Move the decision into virtio_gpu_use_dma_api() and give it the

xen_d

/// Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References