CVE-2026-63885 Details
Description
In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between change_handle and handle_delete drm_gem_change_handle_ioctl leaves the old handle live in the IDR during the window between spin_unlock(table_lock) and the final spin_lock(table_lock). A concurrent drm_gem_handle_delete on the old handle succeeds in this window, decrements handle_count to 0, and frees the GEM object while the new handle's IDR entry still references it. NULL the old handle's IDR entry before dropping table_lock so that any concurrent GEM_CLOSE on the old handle sees NULL and returns -EINVAL. Restore the old entry on the prime-bookkeeping error path.
A race condition vulnerability has been identified in the Linux kernel's Direct Rendering Manager (DRM) Graphics Execution Manager (GEM) handling. The issue arises in the 'drm_gem_change_handle_ioctl' function, where the old handle remains active in the IDR (Identifier Radix Tree) during the interval between unlocking and relocking the table. This creates a window of opportunity for a concurrent 'drm_gem_handle_delete' operation on the old handle to succeed, reducing the handle count to zero and freeing the GEM object, even while the new handle's IDR entry still points to it. The vulnerability has been addressed by nullifying the old handle's IDR entry before releasing the table lock, ensuring that any simultaneous 'GEM_CLOSE' operation on the old handle receives a NULL reference and returns an error. The old entry is restored if an error occurs during the handling process.
The vulnerability has been fixed in the Linux kernel. Users should upgrade to the latest version.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | kernel.org |
| Jul 19, 2026 | New CVE Received | kernel.org |