Bug 2495955 (CVE-2026-53347)

Summary:	CVE-2026-53347 kernel: drm/virtio: Fix driver removal with disabled KMS
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's drm/virtio driver. When the virtio-gpu driver is configured with Kernel Mode Setting (KMS) disabled, the display-related atomic and modesetting components are not properly initialized. This can lead to the system attempting to access uninitialized data during driver removal or unbinding, resulting in a kernel crash. This vulnerability could potentially lead to a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-01 14:03:27 UTC

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: Fix driver removal with disabled KMS

DRM atomic and modesetting aren't initialized if virtio-gpu driver built
with disabled KMS, leading to access of uninitialized data on driver
removal/unbinding and crashing kernel. Fix it by skipping shutting down
atomic core with unavailable KMS.

Comment 1 Mauro Matteo Cascella 2026-07-01 16:05:40 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026070145-CVE-2026-53347-da0e@gregkh/T