CVE-2026-63885

Updated on 19 Jul 2026

Severity

Awaiting Analysis

Details

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

drm/gem: fix race between change_handle and handle_delete

drm_gem_change_handle_ioctl leaves the old handle live in the IDR during the window between spin_unlock(table_lock) and the final spin_lock(table_lock). A concurrent drm_gem_handle_delete on the old handle succeeds in this window, decrements handle_count to 0, and frees the GEM object while the new handle’s IDR entry still references it.

NULL the old handle’s IDR entry before dropping table_lock so that any concurrent GEM_CLOSE on the old handle sees NULL and returns -EINVAL. Restore the old entry on the prime-bookkeeping error path.

Details

Affected packages:
kernel @ 4.18.0 (+6 more)

Fixes