CVE-2026-46215 (GCVE-0-2026-46215)
Vulnerability from cvelistv5
Published
2026-05-28 09:40
Modified
2026-08-05 12:30
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: drm: Set old handle to NULL before prime swap in change_handle There was a potential race condition in change_handle. The ioctl briefly had a single object with two idr entries; a concurrent gem_close could delete the object and remove one of the handles while leaving the other one dangling, which could subsequently be dereferenced for a use-after-free. To fix this, do the same dance that gem_close itself does. (f6cd7daecff5 drm: Release driver references to handle before making it available again) First idr_replace the old handle to NULL. Later, if the prime operations are successful, actually close it. create_tail required a similar dance to avoid a similar problem. (bd46cece51a3 drm/gem: Fix race in drm_gem_handle_create_tail()) It idr_allocs the new handle with NULL, then swaps in the correct object later to avoid races. We don't need to do that here, since the only operations that could race are drm_prime, and change_handle holds the prime lock for the entire duration. v2: cleanups of error paths
References
Impacted products
Vendor Product Version
Linux Linux Version: 53096728b8910c6916ecc6c46a5abc5c678b58d9
Version: 53096728b8910c6916ecc6c46a5abc5c678b58d9
Version: 53096728b8910c6916ecc6c46a5abc5c678b58d9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-46215",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-10T03:55:46.719Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/0xCyberstan/CVE-2026-46215-POC"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_gem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "672464dd53231509c9c771110798c56d4660e19e",
              "status": "affected",
              "version": "53096728b8910c6916ecc6c46a5abc5c678b58d9",
              "versionType": "git"
            },
            {
              "lessThan": "61bd96d3e5472c253f9c1ab77608f0c8aaa9d025",
              "status": "affected",
              "version": "53096728b8910c6916ecc6c46a5abc5c678b58d9",
              "versionType": "git"
            },
            {
              "lessThan": "5e28b7b94408897e41c63477aabc9e1db439bc8c",
              "status": "affected",
              "version": "53096728b8910c6916ecc6c46a5abc5c678b58d9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_gem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.32",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.32",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.9",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: Set old handle to NULL before prime swap in change_handle\n\nThere was a potential race condition in change_handle. The ioctl\nbriefly had a single object with two idr entries; a concurrent\ngem_close could delete the object and remove one of the handles\nwhile leaving the other one dangling, which could subsequently\nbe dereferenced for a use-after-free.\n\nTo fix this, do the same dance that gem_close itself does.\n(f6cd7daecff5 drm: Release driver references to handle before making it available again)\nFirst idr_replace the old handle to NULL. Later, if the prime\noperations are successful, actually close it.\n\ncreate_tail required a similar dance to avoid a similar problem.\n(bd46cece51a3 drm/gem: Fix race in drm_gem_handle_create_tail())\nIt idr_allocs the new handle with NULL, then swaps in the correct\nobject later to avoid races. We don\u0027t need to do that here, since\nthe only operations that could race are drm_prime, and\nchange_handle holds the prime lock for the entire duration.\n\nv2: cleanups of error paths"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via the DRM_IOCTL_GEM_CHANGE_HANDLE ioctl on a local DRM device node (/dev/dri/renderD* or card*); there is no network or remote path to this code.\nAC:L - This is a race condition where the attacker controls both racing threads (one issuing GEM_CHANGE_HANDLE, another GEM_CLOSE on the same fd) and can retry the ioctls indefinitely, so the window is reliably winnable.\nPR:L - The ioctl is flagged DRM_RENDER_ALLOW with no DRM_AUTH/DRM_MASTER/DRM_ROOT_ONLY and no capability check, so any unprivileged local user with access to a DRM render node (standard on desktops/Android/kiosks) can trigger it.\nUI:N - The attacker drives the entire exploit through its own ioctls; no action by another user or victim is required.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; it does not cross a VM/hypervisor or IOMMU boundary.\nC:H - A use-after-free on a heap-allocated drm_gem_object lets the attacker reclaim the freed slot with controlled data and read back object contents/pointers, enabling kernel memory disclosure.\nI:H - The dangling idr entry is dereferenced (kref_get write, plus obj-\u003efuncs-\u003e* calls), and a reclaimed UAF object gives heap-spray-based arbitrary write and control-flow hijacking primitives.\nA:H - Dereferencing the freed/dangling GEM object reliably causes kernel oops/panic, a full denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:33.895Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/672464dd53231509c9c771110798c56d4660e19e"
        },
        {
          "url": "https://git.kernel.org/stable/c/61bd96d3e5472c253f9c1ab77608f0c8aaa9d025"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e28b7b94408897e41c63477aabc9e1db439bc8c"
        }
      ],
      "title": "drm: Set old handle to NULL before prime swap in change_handle",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46215",
    "datePublished": "2026-05-28T09:40:32.050Z",
    "dateReserved": "2026-05-13T15:03:33.105Z",
    "dateUpdated": "2026-08-05T12:30:33.895Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-46215\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-09T17:58:20.077435Z\"}}}], \"references\": [{\"url\": \"https://github.com/0xCyberstan/CVE-2026-46215-POC\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-09T17:58:12.669Z\"}}], \"cna\": {\"title\": \"drm: Set old handle to NULL before prime swap in change_handle\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"53096728b8910c6916ecc6c46a5abc5c678b58d9\", \"lessThan\": \"672464dd53231509c9c771110798c56d4660e19e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"53096728b8910c6916ecc6c46a5abc5c678b58d9\", \"lessThan\": \"61bd96d3e5472c253f9c1ab77608f0c8aaa9d025\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"53096728b8910c6916ecc6c46a5abc5c678b58d9\", \"lessThan\": \"5e28b7b94408897e41c63477aabc9e1db439bc8c\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/drm_gem.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.18.32\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"7.0.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.0.*\"}, {\"status\": \"unaffected\", \"version\": \"7.1\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/drm_gem.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/672464dd53231509c9c771110798c56d4660e19e\"}, {\"url\": \"https://git.kernel.org/stable/c/61bd96d3e5472c253f9c1ab77608f0c8aaa9d025\"}, {\"url\": \"https://git.kernel.org/stable/c/5e28b7b94408897e41c63477aabc9e1db439bc8c\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm: Set old handle to NULL before prime swap in change_handle\\n\\nThere was a potential race condition in change_handle. The ioctl\\nbriefly had a single object with two idr entries; a concurrent\\ngem_close could delete the object and remove one of the handles\\nwhile leaving the other one dangling, which could subsequently\\nbe dereferenced for a use-after-free.\\n\\nTo fix this, do the same dance that gem_close itself does.\\n(f6cd7daecff5 drm: Release driver references to handle before making it available again)\\nFirst idr_replace the old handle to NULL. Later, if the prime\\noperations are successful, actually close it.\\n\\ncreate_tail required a similar dance to avoid a similar problem.\\n(bd46cece51a3 drm/gem: Fix race in drm_gem_handle_create_tail())\\nIt idr_allocs the new handle with NULL, then swaps in the correct\\nobject later to avoid races. We don\u0027t need to do that here, since\\nthe only operations that could race are drm_prime, and\\nchange_handle holds the prime lock for the entire duration.\\n\\nv2: cleanups of error paths\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.32\", \"versionStartIncluding\": \"6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.0.9\", \"versionStartIncluding\": \"6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.1\", \"versionStartIncluding\": \"6.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-06-14T18:03:19.611Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-46215\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-09T17:58:23.605Z\", \"dateReserved\": \"2026-05-13T15:03:33.105Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-05-28T09:40:32.050Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.