drm/gem: fix race between change_handle and handle_delete
In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between change_handle and handle_delete drm_gem_change_handle_ioctl leaves the old handle live in the IDR during the window between spin_unlock(table_lock) and the final spin_lock(table_lock). A concurrent drm_gem_handle_delete on the old handle succeeds in this window, decrements handle_count to 0, and frees the GEM object while the new handle's IDR entry still references it. NULL the old handle's IDR entry before dropping table_lock so that any concurrent GEM_CLOSE on the old handle sees NULL and returns -EINVAL. Restore the old entry on the prime-bookkeeping error path.
CVE-2026-63885
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-63885
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "672464dd53231509c9c771110798c56d4660e19e",
"lessThan": "0dfa42cfe4dbe114533480503934f43e33c1e83d",
"versionType": "git"
},
{
"status": "affected",
"version": "61bd96d3e5472c253f9c1ab77608f0c8aaa9d025",
"lessThan": "cde2c9257cbe8463b9dcf7b1075177b72b5fd938",
"versionType": "git"
},
{
"status": "affected",
"version": "5e28b7b94408897e41c63477aabc9e1db439bc8c",
"lessThan": "7164d78559b0ff29931a366a840a9e5dd53d4b7c",
"versionType": "git"
}
],
"programFiles": [
"drivers/gpu/drm/drm_gem.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18.32",
"lessThan": "6.18.35",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.0.9",
"lessThan": "7.0.12",
"versionType": "semver"
}
],
"programFiles": [
"drivers/gpu/drm/drm_gem.c"
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-63885
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #40881 · Revision 1
- Added to Heist Feed
- Publisher date