drm/gem: Try to fix change_handle ioctl, attempt 4
In the Linux kernel, the following vulnerability has been resolved: drm/gem: Try to fix change_handle ioctl, attempt 4 [airlied: just added some comments on how to reenable] On-list because the cat is out of the bag and we're clearly not good enough to figure this out in private. The story thus far: 5e28b7b94408 ("drm: Set old handle to NULL before prime swap in change_handle") tried to fix a race condition between the gem_close and gem_change_handle ioctls, but got a few things wrong: - There's a confusion with the local variable handle, which is actually the new handle, and so the two-stage trick was actually applied to the wrong idr slot. 7164d78559b0 ("drm/gem: fix race between change_handle and handle_delete") tried to fix that by adding yet another code block, but forgot to add the error handling. Which meant we now have two paths, both kinda wrong. - dc366607c41c ("drm: Replace old pointer to new idr") tried to apply another fix, but inconsistently, again because of the handle confusion - this would be the right fix (kinda, somewhat, it's a mess) if we'd do the two-stage approach for the new handle. Except that wasn't the intent of the original fix. We also didn't have an igt merged for the original ioctl, which is a big no-go. This was attempted to address off-list in the original bugfix, and amd QA people claimed the bug was fixed now. Very clearly that's not the case. Here's my attempt to sort this out: - Rename the local variable to new_handle, the old aliasing wit
CVE-2026-53145
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-53145
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "672464dd53231509c9c771110798c56d4660e19e",
"lessThan": "c0639ede2f24ac224b2079cd35ecd5fd8ad4e3cd",
"versionType": "git"
},
{
"status": "affected",
"version": "61bd96d3e5472c253f9c1ab77608f0c8aaa9d025",
"lessThan": "1d9b93df7fc768228906e24220591ec1cddad391",
"versionType": "git"
},
{
"status": "affected",
"version": "5e28b7b94408897e41c63477aabc9e1db439bc8c",
"lessThan": "1a4f03d22fb655e5f192244fb2c87d8066fcfca2",
"versionType": "git"
},
{
"status": "affected",
"version": "318b995cffcfcaa69a234d28123a3f4ae186a9df",
"versionType": "git"
},
{
"status": "affected",
"version": "38f12d0e10d83b66fa1466400d876a3a8da31542",
"versionType": "git"
},
{
"status": "affected",
"version": "0dfa42cfe4dbe114533480503934f43e33c1e83d",
"versionType": "git"
},
{
"status": "affected",
"version": "cde2c9257cbe8463b9dcf7b1075177b72b5fd938",
"versionType": "git"
}
],
"programFiles": [
"drivers/gpu/drm/drm_gem.c",
"drivers/gpu/drm/drm_ioctl.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18.32",
"lessThan": "6.18.36",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.0.9",
"lessThan": "7.0.13",
"versionType": "semver"
}
],
"programFiles": [
"drivers/gpu/drm/drm_gem.c",
"drivers/gpu/drm/drm_ioctl.c"
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-53145
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #40758 · Revision 1
- Added to Heist Feed
- Publisher date